jijijijij

Will be interesting to see, if AI will cause an increased demand for sysadmins. Not sure companies will go "Make no mistakes" on their (production) infrastructure.

We could use cyber, crypto and AI in one sentence!

Mean sure, but doing just that misses the learning and specific attention part. Going from "bird" to species, learning about morphological, vocal differences is going beyond "being a little more active and interested in your surroundings". It's really engaging every sensory and cognitive system in concert.

That said, collecting plants or beetles is probably equally beneficial. Geocaching comes to mind too.

Although, I wonder if looking up may contribute, given old people tend deform and bend forward with age. Could affect blood or lymphatic circulation.

Congrats!

Ignoring OP's config fuck-up, I think you did a service to the world, showing this vulnerability is very much real.

Are you the one who got through?

> in the binary itself does it perchance end in "fuL"?

Username and that comment earlier matches the "a few hours ago"/"confusion" statement by LiveOverflow.

Nice. Assuming all of this is real, do we get a write-up?

Was it actually php2shell, and/or some other exploit?

Going by the fact the setup was rather hostile to exploitation, for the longest time not even exploitable, and under heavy load, I think we can conclude the threat is very real. Again, assuming it's not funny games.

Edit: LiveOverflow got more info, apparently it was hacked hours ago by @killa lol: https://x.com/LiveOverflow/status/2114488571021398330

>I'm deep within the network right now

Lol, what does that even mean?

I think we can agree the statement makes the implied assumption you still do have a reason to run PHP. It doesn't matter what application needs PHP, as long as it's an application needing PHP. Delivering a static webpage is not a reason to run PHP, that's webserver biz. I mean, c'mon, it's bug in the PHP backend, not the OS where the string "PHP" magically causes memory corruption. Something needs to be processes by PHP.

Also everyone working on an exploit to claim the reward has the interest to keep others from getting there first, so there is a strong incentive to keep the server unusable.

While you are at it, could you also enable ssh on port 22 and slip in my keys for user root? It's what I use in my test setup and my RCE POC relies on it.

Fair enough :D

jAwECQEKMLU49MiDV9LSmgFyUbVA3GI6fCx5U2M+0vra/s81r2NWmfqtJTHM0Yn/J8jkzhq1rlXL5/DvyPNPXr0TJp1HeyLaYLvuGrQb/cDMGDeIOebk8yD48YKxUUTVJJFV0I3mzET1pngQEme9r2HrXrOgWVTASCQU/kEYbRfw9ogbCguFCu4qfVZq3JpzNDF52YS1kwtvKVA/wkb+sN5L5fgqEvsZqc8=

Have you experimented with local models? That would make pretty good, potentially relatable content, I think.

Not gonna defend the OpenAI shilling, but the guy recently had a pretty brutal tragedy in his personal life and I assume the AI content is just a low effort move to keep the channel and marketing for his business afloat. The lack of elaborate educational content may be rather a symptom of personal resource exhaustion and struggle, than popular enshittification. Time will tell, but maybe cut him some slack for the moment.

Would be funny if someone installed a crypto miner instead, or transferred highly tainted coins to get OP onto the radar of law enforcement. Or secretly upgrade the PHP package to mess with people.

They are cutting competition for these sweet coins. Anything to become profitable.

Only works for low value targets, where you don't have to trust your coworkers. Probably need to rotate the key daily, which possibly adds transaction costs. You would also need to set up the detection capabilities to be able to figure out the intrusion path, or the flag is pretty meaningless. And at that point you may just as well put tripwires onto sensitive files.

Speaking of, the PHP PPA was pretty unusable all day. I wonder, if this was just high demand or intentional attacks on launchpad servers to prolong the exploitation window.

... a second feline has hit the stack.

In what world is a global financial crash good for the public? At least short-term this will be painful for everyone.

That, or they are not operating profitable... If demand eats up actual pricing remains to be seen.

You are shifting the goalpost. It's not the original argument anymore.

Why does evolution have to pick one of them?

You are not really thinking this through. How would a fitness reducing mutation become a feature of a genetic line in the first place in asexual reproduction? The "silent" partial carrier dynamic of genetic defects is a problem exclusive to sexually reproducing organisms.

How can sexual reproduction "get rid of them"?

Play it out for a few generations, you will see, there is a frequency equilibrium. We've done this in school with paper, but if you know some programming, it's an easy exercise. Anyway, unless being very detrimental for partial carriers, the bad allele is gonna stay in the gene pool.

No, of course not. But having diploid, paternal and maternal DNA is something you need sexual reproduction for.

Apart from that, it's also wrong because sexual reproduction did not get rid of anything. Just one offspring not affected, but the premise already established the fitness of partial carriers, so that mutation is gonna remain in the gene pool.

The scenario you are painting only exists with sexual reproduction, so it's circular reasoning.

Silly you, thinking the German economy is merit-based. The only question is, if the bribe fits a single token of appreciation, to win a tailored call for bids!

The evolution of sex and sexual reproduction, as opposed to other means of reproduction. It is inherently tied to the difference in genetic maintenance/repair mechanisms between germline and somatic cells. See wiki link above.

Given the fact the large majority of embryos die early after conception, I would call it quite ruthless. And of course, there is intense gamete selection beforehand too.

Sorry, it's not my main interest right now, so I am out-of-the-loop.

Last time I checked, Big Biology was kinda unique going beyond basic popsci, while still remaining interesting and engaging. I think biologists are not the most technically inclined, not really drawn to podcasting. And it's also not the hottest of topics right now, specific research PR and educational voices aren't funded well. There are some journal/university etc. associated everybody-has-a-podcast-now podcasts, but I found them to be rather boring and dry. Individual episodes of the Huberman/Lex Fridman type edgelord podcasts may also be occasionally interesting, but the signal to noise ratio is poor, with a heavy bias towards overconfident and narcissistic guests speaking with false authority, lots of explanatory speculation presented as facts, pronounced political confirmation bias.

Maybe take a well presented episode on Big Biology and see where else respective guests speak or publish?

All of it is a matter of active research, as this relates to the evolution of sex/sexual reproduction, which, contrary to popular belief, is still an unsolved problem in biology. Classical evolutionary theory cannot explain sexual evolution. Any book about "why?" will either be highly opinionated, agenda-driven, out-dated, or simplistic (as are my comments here).

I am not a biologist, so I can not refer to or evaluate any meaningful recent papers on the matter. However, I can recommend the podcast 'Big Biology', which dives into current biology research, theory and philosophy, including sexual evolution.

You may start here: https://en.wikipedia.org/wiki/Evolution_of_sexual_reproducti...

Richard Dawkins' 'The Selfish Gene' is also an excellent read/audiobook. His specific theories of the evolutionary "unit" have been disproven, but his argumentation teaches a lot about "evolutionary thinking". I really wish he stuck with biology and science education instead of becoming this reactionary giga twat.

Nothing flies anywhere, we use superior high speed trains. I faxed a Humorgenehmigungsantragantrag to our Bundesunterhaltungsministerium analyst, immediately. Laugh now, but you are merely lucky the reply got delayed. As soon as the leaves on the rails are dealt with, you will get a formal response that has washed itself! Let us see who is laughing then. It is nobody!