B
@Crell There are 28 such dates every century:
2X03-04-05
2X03-05-04
2X04-03-05
2X04-05-03
2X05-03-04
2X05-04-03
2X05-12-13
2X06-08-10
2X06-10-08
2X08-06-10
2X08-10-06
2X09-12-15
2X10-06-08
2X10-08-06
2X12-05-13
2X12-09-15
2X13-05-12
2X13-12-05
2X15-08-17
2X15-09-12
2X15-12-09
2X16-12-20
2X17-08-15
2X20-12-16
2X24-07-25
2X24-10-26
2X25-07-24
2X26-10-24
@GossiTheDog Our sysadmin and I are currently in the process of fixing the PHP2Shell mess on a couple of dozen sites, using obsolete PHP versions, which can't update, and we do it with a budget of 0, so color me unimpressed.
Also, burn PHP with fire.
@GossiTheDog And even more. (Serious stuff starts after the comic at the beginning.):
@t_var_s @GossiTheDog One of the mitigations suggests disabling that.
@GossiTheDog More information, from various sources:
https://medium.com/@costin.raiu/php2shell-apocalypse-b8dae59dd753
https://cybersecuritynews.com/php-early-exploitation-attempts/
Exploitation attempts seem to have started, despite the lack of public weaponizable exploit.
@t_var_s @GossiTheDog Haven't tried any of the PoCs yet; need the admin's permission. The write-ups contain mitigations but warn that they are not completely sufficient. I've also seen claims that making the site read-only (i.e., disable POST requests) prevents the exploit, if you can afford to do it.
@GossiTheDog Any mitigations for Windows? We have customers running PHP 7 and even 5 who cannot patch (besides, there won't be a patch available for anything but 8).
Or should we just prepare for incident response?
@GossiTheDog Link to the post from which the screenshot seems to have been taken:
https://news.ycombinator.com/item?id=50167754
I've seen claims that the post was deleted - but I can still see it.
Claude.ai rightly points out that when reviewing code, we should focus on the code and not on its author.