Hacker News Reader

Comment by berkes | Hacker News Reader

It needs only one working exploit to invalidate this post entirely.

Even if there aren't any that work OOTB today, there may be tomorrow. Or in a week. They may improve over time. They may combine other vectors. They will probably not exist on Github but somewhere on the dark web as a .zip you pay for in Monero.

They will combine shodan with fingerprinting and other ways to find "older PHP versions". There will be brute force versions, that just try every home router for insecure NextCloud. And so on.

This is real. This is dangerous. This will be exploited. Because I am sure even after all the noise, (hundreds) of thousands of PHP servers won't be updated for weeks. Many running on a forgotten corner of the web, on homeservers, on a VPS that no-one has access to anymore, in a CI, in a company on the old desktop underneath Jim's desk, on a raspberry-pi everyone totally forgot about.

View on HN

There only needs to be one working exploit, and yet even with thousands of people working either manually or with LLMs, no one managed to get one so far.

Again, obvs you should patch your servers, but the point that this is not an easy exploit stands.

How do you know there is none? Because both the PHP devs themselves and the companies involved in the patches said they had working PoCs.

Do note that commonly a blackhat, or state operative will not chuck their code on github, but either try to sell it, or try to use it to quietly get footholds on strategic places.

Because no one has provided one.

The crucial piece of my statement and my question is that such an exploit doesn't have to be on GitHub to exist.

Again: such exploits are typically not distributed, hosted or published on platforms like GitHub. But on forums, boards and shops on the dark or deep web.

https://github.com/9bie/php2shell-bypass-aslr-exp is the real deal.

Just like every other bug, we should patch, but calm down as there seems to be -currently- no evidence for wide rce exploitation in the wild. If that will change this would be new evidence and shall be taken into risk considerations.

Why are you speculating?

> Why are you speculating?

Because the PHP devs and the researchers all explicitly stated that they have PoCs that can exploit it. Are they lying? Exaggerating? Spreading FUD?

I am speculating as to why the ones who have the most information tell us something very different than a "random blogger who tried repos on github".

Touché

> Because the PHP devs and the researchers all explicitly stated that they have PoCs that can exploit it. Are they lying? Exaggerating? Spreading FUD?

We don't know, that's why we are asking for evidence.

> I am speculating as to why the ones who have the most information tell us something very different than a "random blogger who tried repos on github".

But do we know they have the most information? Or are they relying on the same thing everyone else is?

Reply on news.ycombinator.com