Hacker News Reader

Comment by kgeist | Hacker News Reader

I ran 2 PoCs from GitHub today: one indeed expected Local File Inclusion (LFI) to already be present (so it's just LFI with extra steps), and the other one didn't work at all out of the box without some modifications (although I used the same Docker images and all). The second PoC did trigger a real stale write bug in the end, but it didn't demonstrate actual RCE; it just triggered a stale write. And then I wondered, is this the first time ever that the PHP runtime has had a memory corruption bug? I doubt it (I remember a few years ago we had random crashes in production under high load due to an opcache bug). And if it's not the first memory corruption bug in the PHP runtime, why is it being proclaimed the worst vulnerability in years?

View on HN

There is an argument to be made that taking down such a sizable chunk of the Internet automatically qualifies it as a pretty severe vulnerability, even if no actual exploits were involved in causing it.

More seriously, though, I read it as bad because of the potential. All versions of PHP going back a full two decades were affected, all users of PHP are affected regardless of which features they use, and it’s still unclear if there’s an effective mitigation. So the blast radius if anyone does/did have a working exploit would have been enormous.

I'm in charge of my employer's ecommerce website. To me there's a critical difference in severity between a RCE vulnerability and being to takedown/crash a website.

This is all hindsight talking. You act on the information as it becomes available. At the moment, the being safe than sorry rule applied.

It didn't 'take down a sizable chunk of the Internet'. Site owners took down their sites because of FUD and mass hysteria.

It's not getting tripped by "mass hysteria" to be careful and go offline for a couple hours.

Your average site is fine at 99.9% uptime.

We do need to eventually see the proof that this was so urgent. Because if it wasn't then this was effectively a massive DOS attack on society.

"9.2" is a big claim and a powerful justification for action, but with OpenAI involved my faith is very low that this isn't largely a publicity stunt. Especially given the age of the vulnerability.

This should be somewhat testable.

I'd set up a model with cyber capabilities, maybe GLM 5.3, not sure if it needs to be abliterated?

Disable web access and let it work on exploiting the pre-patch PHP version in a VM, given the info we had yesterday.

Can it do it? How long does it take, and writing the findings into a skill, how quickly can it be used on new targets?

I'd be interested in giving it a try, but unfortunately I'm very busy this week.

... meanwhile:

crickets

I think its absolutely getting tripped up by mass hysteria to go offline for a couple of hours without confirming the severity.

How are you supposed to confirm the severity of an unreleased CVE 9?

I think that you might have missed the joke.

It's risk assessment, nothing more. Some weighed the risk high and paused their site. Nothing wrong with that and not hysteria or FUD.

I think the article is suggesting that a sober risk assessment was not done by most folks period, not that they merely perceived the risk differently.

You've got under 5 minutes to decide whether or not a widely reported critical security vulnerability actively being exploited in the while is severe enough to warrant taking down your site or not. The downside for taking down your site is approximately 0, and the upside is that you don't get shrekd

No security expert can or should work that fast. Its a completely reasonable thing to do given the hyperbolic reporting just in case it turns out to be true. Some websites being down for a few hours doesn't end the world

> The downside for taking down your site is approximately 0

> Some websites being down for a few hours doesn't end the world

Many governmental websites are still down and they say might stay down for days or weeks. Some are not directly related to PHP, but auth doesn't work due to firewall hardening or similar. There definitely is a non-zero downside.

Agreed. This is all lazy chair hindsight talk, maybe by those not affected by it. In the moment you act on the imperfect information you have available and you use the safe than sorry rule. And to demand perfect information is also a fallacy, it doesn’t exist until after the fact.

I hear you, but also I'm not so sure. I remember Log4j, heartbleed, etc. and they were just as serious, but I don't recall people just going dark immediately. Scripts to validate whether or not you had exposure were built, people ran them, and if you did have exposure you started checking to see whether or not it was exploited. This timeline for this seems wildly different to me.

Because it’s not the same type. There was no actual info until the patch dropped, with some people in the know , which made it dangerous to leave your site up. The stopgaps were wild guesses. The multi-upload mitigation wouldn’t have worked.

There was no check that could be trusted to be the check to mitigate it. So that left the scenario that we went through.

Presumably the lack of sober risk assessment was on the part of the hyperbolic reporters.

There wasn't any info on the exploits beyond hearsay and the claim that they're very serious, so the risk assessment, sober or not, boils down to "do I trust the PHP people when they claim this is very serious"

Of of course, an excuse to email a user base to say "sorry we're offline for xyz", from a company I haven’t dealt with in 7 years...

> why is it being proclaimed the worst vulnerability in years?

Also announced today: OpenAI’s software vulnerability initiative.

Do you mean Daybreak and/or Patch the Planet? They are not new (https://openai.com/index/patch-the-planet/)

Or do you mean something different?

I mean Patch the Planet. This was the first I had heard of it, and I assumed from seeing the press releases from OAI working their way through journalism’s digestive tract that it was announced today - but perhaps it was previously announced.

If that is case, I’ll refine my statement to “Also happening today: OpenAI is doing a PR push on their software vulnerability initiative”, which I think suffices to convey the same meaning as the original.

All the people with LLM on their hands, looking for fame to post PoCs on GitHub, but without zero understanding whether it actually exploited the described vulnerability. Even that most cited blog post here was pure slop, and the exploit did not actually work.

Reply on news.ycombinator.com