Hacker News Reader

mind sharing some links to those?

So far as I know, nobody has shared or is sharing viable exploits yet.

But you wrote: "There are now multiple posts from vuln research teams all of whom have working RCE POCs against unmodified PHP applications." ? Are those "multiple posts" top secret?

Right, even the full example has not been released, he asserted that there are posts with people saying it, so lets at least see those.

However, that still doesn't actually show that the original post is wrong - since we can't actually see how it can be exploited against a vanilla PHP server.

I have working RCE as long as the server has a memory_limit that is less than the max POST size. From my reading of the PHP patch, there's no way around that part, but a lot of real sites are running like this.

No idea of course if this meets the authors' "out of the box" condition. Who runs a fully stock PHP config?

Reply on news.ycombinator.com