[a / b / c / d / e / f / g / gif / h / hr / k / m / o / p / s / t / u / v / vg / vm / vmg / vr / vrpg / vst / w / wg] [i / ic] [r9k / s4s / vip] [cm / hm / lgbt / y] [3 / aco / adv / an / bant / biz / cgl / ck / co / diy / fa / fit / gd / hc / his / int / jp / lit / mlp / mu / n / news / out / po / pol / pw / qst / sci / soc / sp / tg / toy / trv / tv / vp / vt / wsg / wsr / x / xs] [Settings] [Search] [Mobile] [Home]
Board
▼ Settings Mobile Home
/g/ - Technology

Name
Options
Comment
Verification
4chan Pass users can bypass this verification. [Learn More] [Login]
File
  • Please read the Rules and FAQ before posting.
  • You may highlight syntax and preserve whitespace by using [code] tags.

08/21/20New boards added: /vrpg/, /vmg/, /vst/ and /vm/
05/04/17New trial board added: /bant/ - International/Random
10/04/16New board for 4chan Pass users: /vip/ - Very Important Posts
[Hide] [Show All]


[Advertise on 4chan]


File: php.png (79 KB, 1280x691)
79 KB PNG
>https://www.php.net/archive/2026.php
>The PHP security team would like to give advance notice of an upcoming security release.
>It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
>It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
Quick heads-up: the internet will implode in about half a day from now.
>>
>https://x.com/k_firsov/status/2112641845926989944
I hate weebs so goddamn much. Yeah I know troon website and all.
>>
has it this exploit been seen out in use yet?
>>
>blurred text
>wordpress
>mediawiki
>most likely using the 2 plugins that are vulnerable to this nothingburger
yeah im thinking hype
>>
>>110125038
I don't mind weebs, but this particular one is clearly a faggot.
>>
>>110125539
retard
>>
>>110125574
poc||gtfo
>>
File: php2shell_lmao.png (747 KB, 1395x897)
747 KB PNG
>>110125539
plain php file with RCE
>>
File: 1763662418197268.jpg (354 KB, 860x1389)
354 KB JPG
I think this is getting overshadowed by the certificate issue but this is much worse
>>
php hack el patcho'd
>>
pls gib exploit now
>>
>we're back
finally
>>
welp surprisingly topical thread huh
>>
lol lmao
>>
bruh the whole fucking day
>>
php hacker uses macos. based choice
>>
>>110125814
they probably took the opportunity to also vibe-patch any other potential exploits or at least hopefully if they were smart.
>>
File: 1369861683652.jpg (118 KB, 406x364)
118 KB JPG
i love PHP
>>
Found the jeet who hacked it
>>
Internet collapsed yet? Hacker known as 4chan done anything?
>>
>>110125539
came back just to call you a dumb nigger
>>
>>110125814
remember when a known exploit was found and reported to hiromoot for years and then last year a shartyfag used it to nuke the site and it took 2 weeks to fix the shit? good times
>>
>>110125841
I updated everything that uses the bad eMudhra Intermediate CAs
>>
Can we just execute all php devs and move to something better now?
>>
peehehepee
>>
>>110124972
DO NOT REDEEM BASTARD BITCH
>>
How long until it breaks again
>>
Fuck PHP
>>
>>110125778
technically speaking in certificate case you must have some shitty certificate to be affected right
>>
>>110124972
You know quasimodo predicted all of this
>>
kek
>>
PHP buck breaks 4chan yet again.
>>
>>110125869
saar we provide best saartificates
>>
File: 1792623070787.jpg (23 KB, 380x482)
23 KB JPG
technology is bullshit
>>
Guys I visited reddit before the PHP update and now my PC has RCE cyberaids
>>
FUCK PHP
>>
>>110124972
We need a list of sites that got taken down and sites that get hacked in the next few weeks
>>
>>110125539
this was the last post I read before everything went to shit.
Well done
>>
We back, homies? We still swol?
>>
what took these cocks here so long to apply security patches? the fixes have been available since the morning
>>
>>110125896
A list of millions of random wordpress websites? why?
>>
php won
>>
>>110125888
Just memeing but I guess this would mainly affect the site themselves, not the users. Would be a problem with exploited php on those jeet sites with 4 as their certiicate
>>
>>110125914
>>110125834
>>
4chan is the only site that I use that had a problem
>>
File: 1782165068394241.jpg (27 KB, 680x680)
27 KB JPG
WHY ARE WE PHP?
>>
>>110125920
Ignoring that shit obviously (or filtering it out would be good)
>>
>>110125934
because php was *the* language to pick back in the 90s/early 00s for anything web related.
>>
File: 1724031593621568.png (163 KB, 399x498)
163 KB PNG
so does this overshadow the CA oopsie and everyone forgot about them
>>
So in the current year, why are they using PHP instead of something modern like Python?
>>
>>110125971
you mean typescript
>>
File: 1791693126227182.gif (1.84 MB, 400x218)
1.84 MB GIF
>>110125934
>>
File: 1696130110596275.png (91 KB, 287x335)
91 KB PNG
because 4chan was read-only but not completely down all day, I re-opened different boards and wondered why there were no new posts at 5 times during the day.
I hope in the future they take the website down completely during situations like this.
>>
File: 1792355957092470.jpg (42 KB, 640x389)
42 KB JPG
>>110125934
Because it's fucking php or javascript.
>>
>>110125983
The main page was down, retard
>>
>>110124972
Remind me to never use this piece of shit language
>>
>>110125971
if it ain't broke don't fix it (until it breaks then take 2 weeks to fix it)
>>
>>110126010
Don't interact with the retards.
>>
>>110125931
4chan is the only site that I use
>>
>>110126023
You mean C, the language to blame for the actual error?
>>
>>110125931
Because shocker most sites are well maintained and aren't based on ancient PHP code.

Somebody probably had to backport fixes manually by hand for this ancient codebase rather than simply updoot the modern PHP version.
>>
>>110125539
/thread
>>
>>110126035
I'm already not using that piece of shit language
>>
File: 1784092829612510.png (182 KB, 594x1271)
182 KB PNG
>>110125778
>>
>>110126045
Good.
>>
>>110125778
It's not a certificate issue, it's an Indian issue.
>Saar, I, Mr. Sakmir Poobshard have done the genretering of the seekret key, saar, perfect for gorgeous looks, can request CA certs asap
>>
>>110126045
But Lua is the best language in the world, and its father is C. So C cannot be shit.
>>
>>110124972
Why did it take so long?
>>
>>110126084
All the distros and other distributors had to coordinate and release the fix at the same time and that's difficult in this global world.
>>
>>110126084
Ancient codebase that needed fixes retrofitted. They're not going to modernise it to PHP 8 and add support for webp and jxl and avif and av1.
>>
>>110126077
Whoever set up those private keys literally picked a number between 0 and 256 because of "256-bit encryption".
>>
>patch was out since 3
>it took gook moot 5 hours to fix the site
>>
>>110125883
I wouldn't be surprised if all the major browsers just outright remove that authority's trust root entirely even if they fix their issue, they're obviously not worthy of trust
>>
we're probably still fucked
>>
>>110126084
from what I understand php knew about it months ago, disagreed on how to fix it and sat on it because there was no exploit in the wild, and openai found it separately and then it was in the wild
so openai leaked it somehow?
>>
>>110126089
My Debian servers were patched at 15:02 lol
>>
>>110126089
The distros do that all the time. Gentoo even got the fix out before the 2 PM deadline. It took more time for me to re-build my Docker containers than it did for them to release it.

Distributions security teams are excellent. Thankless heroes that do great work.
>>
4
>>
>Guy posts blurry anime cat girl pedo vidoe too early
>Everyone panics and leaks the disclosure
Why are weebs like this? Why didn't he just wait until it was disclosed?
>>
>>110126096
vagueprompting Claude and waiting for test harnesses to run takes time okay?
>>
>>110126109
Not all of them. Nixpkgs STILL doesn't have it.
Inefficient shit package manager when it comes to that.
>>
File: smug gadget.jpg (26 KB, 537x571)
26 KB JPG
>>110126038
>most sites are well maintained
>>
>>110126104
see >>110126118
Calif leaked it too early because he wanted to get his anime girl video out first
>>
>>110126089
why exactly couldn't the php guys upload the fix first and let people patch it manually? why coordinate with distros
>>
>>110125539
KWABOTY
>>
A full day to patch a PHP vulnerability in the age of AI.
This place is run by complete incompetent clowns.
>>
File: lmao.png (45 KB, 571x561)
45 KB PNG
>>110125539
lmao
>>
>>110126148
>This place is run by complete incompetent clowns.
Next you'll say that water is wet.
>>
>>110125539
people are clowning on you and yet I've seen no proof of this vulnerability being exploited in the wild, only screenshots of people getting shells on labs
>>
File: 1771414980586409.jpg (70 KB, 733x753)
70 KB JPG
>>110126148
There is not a single person on /g/ who could patch it any faster.
>>
>>110126140
Because it's irresponsible to just drop a RCE out of thin air. By announcing it they gave people a heads up that shit's on fire and the fix is coming at that time/date.

Yes, in the modern world of AI responsible disclosure ain't perfect. The AI can find the bug early as happened in this case but still it's important that people are informed so that they patch their shit.
>>
>>110126165
AND, THE POSTERS r ALL IDIOT!
>>
>php vulns
Are we back in 2006?
>>
The 4 stands for 4chan saar
>>
>>110126168
it took me a grand total of 30 seconds to update my webservers

apt update
apt upgrade
systemctl restart nginx
>>
>>110125778
>Had some bigass rant that I couldn't post because php fuckery

No this affects a significant number of American Universities that had to pivot to Certinext (Owned by jeetMudhra) between June and July. All certificates issued through Certinext using ECC use the same root CA that signed the compromised certs and thus are also being un-trusted by browsers.

American higher-ed has been REDEEMED
>>
>>110125038
They should flay this nigga and the other faggot who used AI to find it alive on TV
>>
>>110125539
imagine being this guy, truly embarrassing
>>
>>110126181
You retard, you're still vulnerable. You needed to restart php-fpm
>>
4saars did this
>>
>>110126148
That's kind of how zero-days work, friendo.
>>
>>110126096
Hiro doesn't even remember he owns this piss bucket of a site.
>>
>>110126184
This post was meant for
>>110125869
I've been spending all day un-fucking both of these fuckeries. I'm tired.
>>
>>110125038
why are they/them like this bros
>>
My windows install most likely died because of this bullshit. I have no idea how or why it happened but I noticed I couldn't get into the display settings and then the entire systems setting section wouldn't open. Restarted the computer after doing some basic attempts fixing missing files and it was broken.

I'll never forgive AI for this.
>>
>>110125320
No, mossad has kept it to themselves.
>>
>>110126148
The people who manage this website don't have the skills to update this websites code properly, which is why it was completely untouched after moot left
4chan is basically held together with strings and glue and hopes and dreams
>>
How many apt update and upgrade am I gonna have to do today?
>>
>>110126140
People have hundreds of servers to go through, they don't want to uninstall the package manager version, install a dev environment on every server, compile PHP and all extension and then deal with all the differences between the version they compiled and their distro's packaged version. They want to tell their package manager to update and then systemctl enable --now php8.5-fpm.

The PHP team thought that the moment they release the patch, is the moment the exact details of the vulnerability gets known and that this would start the countdown before everyone begins developing their exploits based on the vulnerability. So they wanted all the package managers to provide fixed versions of PHP the moment this knowledge gets out.
But thanks to AI, what actually happened was that people knew vaguely which part of PHP the bug was in due to the disclosure and they asked chatbats to find it and create a POV, which it did, hours before the coordinated release. So I guess this doesn't work anymore in 2026.
>>
>>110126212
this is basically what every good website does.
It proves 4chan is still real.
>>
And that's why I don't use PHP for fucking anything. It's always been trash.
>>
>>110126032
This.
>>
i bet quite alot of smaller older gaming forums and such are completely vulnerable right now
you dont plan on doing anything bad do you anon?...
>>
>>110126216
ca-certificates, all web browsers, any golang program, any rust program that bundles PKI, etc, PHP as well. So maybe a few times?
>>
>>110126229
you mean all those sites that are now just locked down and the top post is a link to a Discord server that replaced it
>>
>>110126098
I truly hope they do, despite the fact it's going to create a significant amount of work for me. Fuck em.
>>
>>110125965
not really, most normalfags (like, non-tech, why is my laptop not working-tier) I've seen are talking about the two, but rightfully saying that the php one was the more dangerous, although they are parroting tech sites for that opinion
>>
>Personal Home Page
>Poo Home Page
>>
>>110126208
picel did it.
the cutn.
>>
>>110126260
It was supposed to just be a template engine…
>>
>>110126168
@Clade prove this retard wrong

I'd bet anything in the world that it wouldn't take Claude more than 10 minutes to have patched this.
>>
File: 1777530497226.jpg (130 KB, 914x1200)
130 KB JPG
Oh, so that's WTFTW.
>>
>>110126244
alot of runescape private server forums seem to be up and running and they're all basically build on phpbb and equivalent. Seriously doubt they've been updated.
>>
File: 1376168847314.png (115 KB, 422x347)
115 KB PNG
>>110126244
>forum locked down but still online
>use PHP exploit to open it up again
>>
>>110126270
>Rasmus, add mysql to php
>b-but... you're supposed to do that from C, then use php to render the resu-
>Just wrap the C library, do it

Feature creep really fucked this language up forever. It was never meant to be a programming language.
>>
kind of a dickmove to publish a php 0day in 2026.
the only websites still using that crusty ass backend are cool ones like bbforums and this shithole.
none of the big social media sites were affected.
>>
>>110126301
Kind of a shame Facebook forked PHP / developed Hacklang.
>>
>>110126148
No one run this place, it's one guy on his spare time.
>>
>>110126301
Isn't Facebook still PHP? Or do they still have that "Hack" language?
>>
>>110126003
or??
>>
>>110126301
It was a fuck-you to everything self-hosted, but it had a massive impact on all the businesses still using Wordpress.

Fucking Pokémon uses Wordpress for some of its games' individual sites, and integrates those into the apps for news and shit.
>>
>>110126313
>>110126317
i thought they switched to react over a decade ago?
>>
File: 1000028933.png (1.72 MB, 2048x1422)
1.72 MB PNG
>>110124972
Can someone explain this happening as if I only browse /pol/?
>>
>>110126313
PHP was shit before PHP 7 to be fair
>>110126323
React is just frotnend
>>
>>110126195
Hahahahahahahaha GOTTEM
>>
>>110126327
No, fuck off back to your daycare for fatties.
>>
I don't understand how a TLS certificate password gives you remote code execution to a server.
>>
>>110126189
isn't he committing some sort of crime by revealing security flaws like this when he should know better? like criminal negligence or sabotage or something. government websites were affected.
>>
So I was browsing some wordpress site earlier today. Am I f___ed?
>>
>>110126327
the jews (php) got gassed (exploited) by the gestapo (AI)
>>
>>110126348
is that what the exploit was or are we crossing streams from the india thing
>>
>>110126348
You're mixing up two different problems that happened today. Good fucking job.
>>
>>110126098
They lost all their certificate izzat. Maybe they'll be lucky to reincarnate as a scam call center employee next cycle.
>>
>>110126354
Yes you should delete the system32 directory to be safe again
>>
>>110126356
You're crossing the piss streams, anon.
>>
>>110126348
>how a TLS certificate password gives you remote code execution to a server
it doesn't, this is a separate vulnerability that also made headlines just before the PHP vulns. People online are conflating the two.
>>
>>110126348
That's because there's so much shitposting around the jeet certificate fuckup that people are mixing it up with a 10+ year old PHP bug.
>>
>>110126358
technically, that`s known as `conflating`
>>
>>110125934
I used the source code leak and had codex rewrite it in rust and it just worked. Even wasted tokens on making a good admin panel.
>>
>>110126240
why can't nu-langs use the OS certificate store like C#?
>>
>>110126348
Those are different things. The CA thing was a jeet generating the private keys for his trusted CA by generating a single byte long key.
>8 bit top notch security, only 0.390625% chance our key will be guessed ,saar.

The PHP vulnerabilities are C use after free errors in the multipart/form-data handler.
>>
>>110125770
So where can you find this shit? the modern goyternet is so sanitized and shit
>>
File: 1782329995589210.jpg (28 KB, 310x310)
28 KB JPG
>>110126331
>React is just frotnend
Do we tell him?
>>
>>110126384
It's a conscious choice by applications and not a language problem.
>>
>>110126384
Go likes static compilation / standalone binaries and including ca-certificates in every Docker container, etc, bloats the image.
The downside is you need to re-compile everything.

For Rust, it's trendy to use Rustls with embedded PKI so you don't have to link to OpenSSL crap. It has the same downsides as Go though.
>>
>>110126167
I don't want to dismiss what happened today but you have a point.
Maybe people that use PHP are so good that bad actors didn't have the time to screw things up before precautions were taken
>>
Can anybody help me to understand exactly what the vulnerability was? I was reading the Wiz website's explanation and it seems like the remote shell after cleanup one was exploiting stuffing something in memory space by first canceling an upload, then coming back and jamming the upload with the bytes you want to get into memory. Then when the housekeeping for the unserializer (they called it that, I would think it would be deserializer, but whatever) ran, it would naively trust that memory space and execute the code?
>>
File: 1757977686197377.gif (344 KB, 500x491)
344 KB GIF
>>110125539
>>
Today was actually a triple whammy
>php and jeet cert
>YOU MUST UPDATE NOW
>exact same time, supply chain vulnerabilities start popping up as everyone is blindly updating everything as fast as possible
Kino
>>
File: 1774422333105047.jpg (171 KB, 1220x608)
171 KB JPG
>>110125847
>implying 4ch even can afford new servers, let alone competent IT
>>
>>110126148
They didn't have a choice. It wasn't until 2 that the patch was released.
>>
>>110126409
To be honest, I expect Cloudflare's WAF that had an emergency rule update will be doing heavy duty in a lot of places.

A lot of people are shit at keeping on top of patches but they have their site behind Cloudflare. Probably they'll release some Blog article at some point talking about all of the attempts they've seen and stopped.
>>
>>110126409
>before precautions were taken
You could be right if the PHP fuckers weren't alerted a month ago and just sat on it.

>>110126411
Wildly unaccurate, but in dumb language I've seen.
>access site
>ddos it
>send a thing
>you receive the php code
>>
>>110126168
grok, fix this shit
***
(32 minutes later)
*fixed*
>>
>>110125934
the entire internet is
>>
>>110126397
No. Leave him his blissful, childish ignorance.
>>
>>110126436
Oh, they already did make a blog! They're never one to miss out on a bit of publicity.
https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
>>
>>110126455
Some new age shit I've heard called Odoo uses Javascript.
>>
>>110125539
KWAB RETARD
>>
Websites relying on php was a huge mistake
>>
>>110126301
Onlyfans was down all day.
>>
>>110126411
Both basically involve heap spraying and then triggering either bug. One is a use-without-initialization that gives you a trivial longjmp and the other is a use-after-free that's a bit more complicated to exploit.
>>
>>110125539
lmao
>>
>we're going to announce it 12 hours in advance so everyone is ready to update
>every jeet points deepseek at the codebase to find the bug and posts the exact bug on Xitter 6 hours early, it starts getting exploited in the wild
meanwhile, php didn't even fucking coordinate the release of the official docker images so they took hours before they were also updated

https://github.com/docker-library/php/pull/1694
>Please wait until a maintainer has come around to look into this.
>>
>>110126481
You should build your own containers.
>>
this was a warning shot to all websites and business that aren't major corpos

all your shit can be taken away LIKE THAT LIKE NOTHING

SO GET IN LINE

THIS IS JUST WHAT THEY TOLD YOU ABOUT
>>
>>110126411
Basically, PHP VM (Zend) implemented exceptions wrong, because cniles are shit programmers with a shit lang, that allowed for a malicious actor to inject php bytecode into an improperly recycled php process and execute arbitrary code.

They triggered a specific OOM condition exception using their really low quality multipart/form-data parser. As far as I can see, only mod_php users were really affected, but php-fpm, maybe.
>>
>>110126493
anyone with a minimum of tech experience does, but the great majority of interwebz users are drooling retards who use prepackaged shit
>>
>>110126493
I'm not doing all that shit just to support some niggers wordpress blog
>>
>>110124972
PHP fags should be hanged
>>
>>110124972
man, what a ride this shit has been

PoC here, btw. apparently the last releases are still vulnerable. just saying, in case someone wants to try it somewhere... :^)

>>110125539
aged like milk lmao

>>110126167
https://github.com/ikow/php2shell-poc
there were reports YESTERDAY of it being exploited in the wild
>>
>>110125539
APOLOGIZE
>>
File: 1778749275458923.jpg (12 KB, 300x294)
12 KB JPG
>>110125539
>>
wut if 4chin still has easily exploitable PHP vulnerabilities despite the 24 hour downtime to patch it and gets rekt again by script kiddies?
>>
>>110126167
this. where are all the pwned sites? 127.0.0.1 doesnt count.
>>
https://bsky.app/profile/ketanjoshi.co/post/3myfu6elzgu22
SAAAAAAAAR EVIL WHITEY WAS 4 ALWAYS
DO NOT REDEEM SAAAAAAAAAR
>>
>>110126536
>Chains D and E exploits are available to paid subscribers.
Lol
lmao even
>>
So what exactly was the problem? Don't tell me yet another buffer overflow.
>>
>>110126572
This should happen tbdesu. RapeApe deserves it.
>>
>>110126229
Any decent managed host WAF'd it and applied the patch immediately. Nobody with a hobby pokemon blog even noticed. The problem situation is guys running sites on unmanaged servers. But even then I bet the hosts of unmanaged stuff strong armed some remediation without the owners knowledge. The host would have to be very crappy not to have taken any action by now.
>>
>>110126593
ye, but this one gave you RCE perms somehow
>>
>>110126167
literally every rce ever.
>>
>>110126424
I respect it
>>
>>110126167
im actually so mad right now. this is like saying racism doesn't exist when it clearly does (you see it with your eyes).
>>
>>110126572
The AI corps are throwing a pretty serious amount of compute to find them so they'll probably find them first.
>>
File: 1772722468531261.png (282 KB, 755x1012)
282 KB PNG
>>110126574
evil cloudflare is protecting them
>>110126593
you won't believe this
>>
>vulns basically allow you to corrupt some global state variables
never understood how these kinds of vulnerabilities end up leading to RCE. Sure, you can edit some memory that something else references but isn't it super difficult to corrupt it in the exact way you would need to gain arbitrary execution?

is it even confirmed that you can actually gain RCE or is it just a
>""well - potentially! someone could gain RCE!""
>>
>>110126604
hypefags read "all php is vulnerable" and immediately took that to mean everyone is hacked
>>
>>110126536
>github
i know you dont understand what you are reading, you literally just posted what anon was talking about, these are lab exploits, not the real world. the ai slop cover image is a nice cherry on top.
>>
File: images.jpg (20 KB, 335x597)
20 KB JPG
>>110125539
But I just ordered a nothingburger.
>>
>>110126634
>how these kinds of vulnerabilities end up leading to RCE
the answer is always C
>>
>>110126634
anon, there were actual, in the wild, examples of that shit being exploited
>>
>>110126501
>really low quality multipart/form-data parser
Yeah, this is why the Wiz notes mention if you start seeing lots of multipart requests, its likely someone trying to attack you with this exploit.
>>
>>110125539
Retard.
>>
>>110126634
You just spray and pray.
If enough memory is filled with something that will result in the exploit triggering, then you just flood the memory, trigger the exploit and cross your fingers the bomb explodes in the right way.
>>
>>110126659
surely you can post examples then. go on, give us the links so we can laugh at you.
>>
>>110126536
That GitHub PoC is AI slop and doesn't work says the issue

Also you need Local File Inclusion and if you have that you have access already anyway?
>>
File: HVKskGEWgAA38AO.jpg (44 KB, 596x766)
44 KB JPG
>>110125885
I prefer this one
>>
File: file.png (365 KB, 640x480)
365 KB PNG
>>110126212
moot didn't have the skills to update this site properly either
there was never a time when 4chan wasn't trash code held together by duct tape and dreams
>>
on the downlow my waf block set up prior to the embargo releasing was catching the traffic. shortly after a few blocks php released the patch ahead of schedule. shit was hot fire fr fr
>>
>>110126699
change the other block for php and its golden
>>
>>110125914
>>110126084
they could have applied the mitigation measures. the people managing this site are retards.

>>110126077
it's an indian CA issue

>>110126104
one of the bugs was known for more than a decade.
>>
Is it even safe to go to old websites anymore? Unless the website owner goes in and fixes it, the site could be compromised right?
>>
>>110126634
In this case it relies on PHP processes (their memory) being reused to speed up handling requests. Many (all?) of these sploits result in early termination of the process.
>>
>>110126659
Such as?
>>
>>110126756
These are targeting server owners, not you the user, except maybe your data on said servers.
>>
>>110126763
That's what you would THINK happens, but this funny little thing called overcommit exists on any Linux server. If the server has swap, you can fill the entire memory and then some.
>>
File: does-he-know.png (33 KB, 319x180)
33 KB PNG
>>110124972
>>
>>110126782
OOM in this case, as far as I know, is specific to how Zend allocates and enforces memory limits. I don't believe it's a "real" Linux specific OOM.
>>
File: lol (2).png (18 KB, 802x126)
18 KB PNG
>>
>>110125539
We're gonna hook you up by the nuts to jumper cables.
>>
>>110126798
Wild guess: hiroshimoot just backported the patch.
>>
>>110125539
>anon was literally right
>everyone pretending he was wrong because of mass hysteria
fune
>>
Absolute nothing burger.
>>
>>110126168
Artisan hand made update.
>>
>>110126815
Yeah, because it got patched dumbass. Expect to see a lot of older unmaintained servers fall over dead as the botnet sweeps them up within the month.
>>
File: 1773436837608677.png (620 KB, 900x900)
620 KB PNG
>you can actually make some money ripping old paid porn sites
>found one using PHP 5.6
>try some PoCs I found on github
>none of them found any vulnerabilities
I find it hard to believe there's a competent porn webmaster out there
>>
>>110126798
>Not knowing the language version of the application you maintain
WTF. Probably depending on Cloudflare-tier defenses for the main site, if that's the case.
>>
>>110126833
two more weeks until the internet dies
trust the plan
>>
>>110126756
Sure as long as you don't put any important details into them because someone else might get access to it.
>>
>>110126181
4chan uses angie now.
>>
>>110126840
that's because there is no exploit for this that can be used blindly in any vulnerable PHP website and even if there was it wouldn't be public, you benched demon bitch
>>
>>110126850
It isn't the web server, anyways. Restarting nginx or angie does jack shit.
>>
>>110126756
i wouldn't unless you like getting fucked in the ass. php executes the moment you press an a href or whatever
>>
>>110126643
>>110126685
well, here's the write up: https://calif.io/php2shell/

>you need Local File Inclusion
no.
https://www.youtube.com/watch?v=pfWZrdzvooc
https://www.youtube.com/watch?v=cE4h79AWbT4

>>110126847
that has literally nothing to do with these issues, mr. Peter Thiel shill bot. these bugs are OLD. PHP knew about them since 2004 and did NOTHING to fix them.
>>
They knew about this since 2024 and it was only disclosed by a Israeli based company for ??? reasons.
>>
>>110126833
>Older unmaintained servers
Those have been getting pwnd since before you were old enough to get on the Internet sir. Even cheaper shared hosts already patched this.
>>
>>110126841
that's not 4chan dumdum that's one of the archive sites
>>
>>110126871
I'm older than TCP/IP, faggot. There hasn't been a flaw this bad in a very long time.
>>
>>110126870
The jews are going to use this as some sort of mass censorship thing, aren't they? The internet makes it hard for them to do what they do without scrutiny, after all.
>>
>>110126867
that's a lot of text and cringe anime girls and no proof of it being exploited in the wild
>>
>>110126867
wasn't the saying "talk is cheap, show me the code"? Show me a working code and any website that has been hacked using it not just some shitty localhost environment
>>
>>110126882
Thank you. I did not know archives had their own boards.
>>
File: output.gif (1.18 MB, 320x231)
1.18 MB GIF
>>110124972
jesus christ i literally took down my website the day before i heard of this
>>
>>110126884
You are going to see more of it. Despite all the failures of the shit, it's not going full pwnage like it could have.
>>
>>110126932
neat. php users have sliding goalposts.
>>
>>110126884
>There hasn't been a flaw this bad in a very long time.
Then why aren't we seeing any fallout from it?
>>
>>110126955
Oh, I know. Hate as I might to admit it, this is only the beginning. AI exploitation is almost certainly going to burn the entire old internet to the ground.
>>
>>110126888
>>110126932
well, this company says they've observed exploitation of these vulns in the wild: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
consider that NO ONE will tell you "yeah, we have been exploiting this undisclosed vuln for 30+ years :^)" just because you think they should. these exploits are sold for at least $x00.000 in black markets.

the author even says there could have been previous exploits that the LLMs ingested:
>There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives
>>
File: file.png (80 KB, 1111x590)
80 KB PNG
>>110126969
lol, lmao
>>
>>110126958
https://www.reddit.com/r/PHPhelp/comments/1xc1rbg/old_php_56_site_got_hit_after_php2shell_how_do_i/
can't verify so dunno haven't seen many reports of people getting fucked
>>
I just went to check an ancient /d/ text story site and I'm not surprised it stopped working.
>>
>>110126969
>30
*20

>>110126994
>security company offers its products
STOP THE PRESSES!

do you know how the security industry works? do you guys even work (in tech)?

why are you in denial? are you a PHP dev, like >>110126958 said? LMAO
>>
The happening retards can't accept that old unmaintained servers have always been getting hacked and nearly any site they use is on a managed host who remidiated it before they could get a happening
>>
>>110126725
>known for more than a decade
>nothing happened
every single cve is just padding someone's resume. none of this shit ever actually gets exploited.
>>
>>110126808
i know im right. its those fags that gave me (You)s that have quietly left the thread. maybe on their way to get a covid booster vax.
>>
>>110127034
>none of this shit ever actually gets exploited.
you've never found a vuln yourself, and don't know how much a remote pre-auth 0day exploit for multiple popular targets can be sold for. gotcha.
>>
>>110126808
did you just wake up after a 20 hour tendie induced coma from your bedroom in your mother's basement
>>
>>110125539
tpbp
>>
>>110127059
>hurrdurr i gaslight to prove a negative
you got nothing but autism, faggot
>>
>>110127066
Websites were taken down by the developers to patch the vulnerability. Nothing was hacked. It is a nothingburger.
>>
File: me.jpg (46 KB, 900x624)
46 KB JPG
>>110127066
Why yes, I did, how could you tell?
>>
>>110127077
i got a bunch of hacking in
>>
>>110127077
See>>110126999
>>
>>110126969
>NO ONE will tell you "yeah, we have been exploiting this undisclosed vuln for 30+ years :^)"
the people getting exploited would disclose it, retard. that is, if there were actually anyone getting exploited LMAO
>>
>>110127092
>one (1) Reddit post that says his website runs on ancient architecture vulnerable to a million other vulnerabilities
The internet is truly over, it's the apocalypse.
>>
>using PHP
>not assuming there are at least a thousand unpublished 0-days for the popular php apps
Deserved.
>>
Why did it take 4chan almost 12 hours to apply a fix when KF did it in 2?
>>
>>110126808
>I didn't even read about the software affected by the vuln
lol, lmao even

>>110127076
>gaslight
>>110127102
>the people getting exploited would disclose it
thanks for proving my point. you have no clue works in the real world, faggots
>>
>>110127092
>Citing a random reddit post from a guy on php 5.6
Let it go
>>
>>110126756
>>110126860
just to be clear it isn't php that'll execute but rather some javascript payload that steals your session cookies with cum dripping out of your asshole
>>
>>110127113
custom ancient version
>>
>>110127114
>hacks are le super sekrit no one knows they got pwned!!!
thanks for proving you are an underage retard that thinks software is black magic
>>
>>110125965
What do you mean? The entire world is talking about it. And yeah, this is a lot worse than redeeming the CA private key.
Imagine all the websites that are running right now unpatched, and imagine how many of them will never get patched at all.
>>
>>110127104
The apocalypse was in 2012 with heartbleed. Nobody exploited ever knew it was happening.
In 2001 I owned half of Korea and none of them knew I was using them to ddos my entire country to disconnect it from IRC so I could get OP on a channel with 50 people.
In 2008 almost every website could be defaced, it was just pointless unless you had a meme target like SOHH talking shit about muh 4chins. That applied to most sites until like 2016.
>>
>>110127180
What do you think was happening to unpatched servers before this?
>>
>>110124972
So fucking sick of GoDaddy.
I don't use them, obviously, but a client does. Can't update shit because I can't be given more than FTP access. GoDaddy's unclear as fuck where to update the php patch and they don't seem to be doing it themselves. Client says they can only select the version, 8.2, 8.3, etc, at which point it sets it to the version prior to the latest patch.
How the fuck does the biggest php/WP hosting company not update this shit within like an hour of the event?
>>
>>110126870
we need to securitize the internet. it's just that simple.
>>
>>110127204
Before AI, they only got raped every once in a while. Now they will get raped a lot more frequently.
>>
indians never ever
>>
File: 1784609023132978.gif (1.59 MB, 375x200)
1.59 MB GIF
>>110127219
>>
this is obviously a psyop to justify the internet being a monolith
>>
>>110127269
explain why that's a bad thing
>>
>>110127269
yeah time for everyone to switch from wordpress to squarespace! 30 day free trial if you use code NIGGER
>>
>>110125934
To be fair, it just werks, unless there's jeets involved
>>
>>110127176
>bro, you will always notice when your shit gets hacked b-because I say so
>it's just software bro!
the fucking IRONY lmao

>>110127269
it's a PHP issue, retard
>>
>>110127278
share w/ jeet
>>
I heard there was a Node.js vulnerability too, but nobody's talking about it, so I suppose that's just business as usual in the node world?
>>
>>110127107
it really was lucky that this happened to an ecosystem that was already known to be swiss cheese
>>
>>110125858
holy fucking kek
god bless
>>
>>110127303
the "issue" is not real though
>>
>>110124972
WHAT THE HELL HAPPENED? WTF?
I almost died! Couldn't post FOR HOURS!
>>
>>110127353
what did you do when the site was down for literal weeks?
>>
>>110124972
php is janky old unsecure 90s tech. it needs to burn in a fire
>>
>>110127205
Supposedly their managed WP hosting is already patched
But apparently for web hosting they use custom PHP packages which are of course provided by a third-party vendor who hasn't provided updates yet... whoops
>>
>>110127192
I remember logging in to Gmail with brute forced passwords. Was hilarious actually watching a guy write an email live. Today you need a 2nd email, a phone number, and an ID even if you are a legit user but Gmail thinks it's not you because you changed your IP address.
>>
>>110127113
>Why did it take 4chan almost 12 hours to apply a fix when KF did it in 2?

Dev was probably asleep since the fix came out in the afternoon in UTC, but 4chinz is hosted in the USA. I could update my servers basically the minute the patches came out.
>>
So did anything of note fail to update and get got?
>>
File: image.png (164 KB, 827x918)
164 KB PNG
>>110125539
IGNORE THE GLOWING RETARDS
>>
>>110126148
You wanted them to fucking vibecode a critical security fix?
>>
>a real command shell needs a directly exposed php-fpm port
nothingburger
>>
File: 1782117404342670.png (187 KB, 596x766)
187 KB PNG
>>110126716
>>
>>110126798
It would be so fucking hilarious if 4chan was still using PHP5.

Why are the archives using PHP7.4 instead of 8 though? Last time I checked most shit that worked on 7.4 worked just fine on 8 and 8.1 with a bunch of warnings (some really weird old php4 era loop functions got deprecated). The one thing that broke a lot in 8.2 was dynamic properties in objects but there's a workaround for that:
    private array $dynamic_props = [];
public function &__get($name) { return $this->dynamic_props[$name]; }
public function __isset($name) { return isset($this->dynamic_props[$name]); }
public function __set($name, $value) { $this->dynamic_props[$name] = $value; }
public function __unset($name) { unset($this->dynamic_props[$name]); }
public function get_data_keys() {return array_keys($this->dynamic_props);}
>>
Requires file uploads to be enabled
Could have just turned images off for the day
>>
>>110127400
Yikes.
The whole idea of managed vs. unmanaged should be:
>One option they hold your hand, but you get to do limited customization.
>Second option you're on your own, but have control over your shit.
The amount GoDaddy bubblewraps stuff regardless has had me confused on multiple occasions whether I'm working with "managed" or "unmanaged" hosting over the years.
Sounds like the client is finally being convinced to get away from GoDaddy though, which will be nice. I'm just hoping they do it one project at a time and not tell me to migrate 30+ sites overnight.
>>
File: file.png (380 KB, 1365x1877)
380 KB PNG
>>110127455
Tbh I have no clue what this company is or does but seems to be well known:
https://blog.railway.com/p/security-disclosure-wednesday-october-21st
>>
>>110126184
They never lear.
>>
>>110127557
and what does this have to do with php?
>>
>>110127550
>Requires file uploads to be enabled
It was not known exactly what it required, early reports said you could disable multipart content-type when POST method is detected and be safe. Another one recommended disabling session.upload_progress.enabled.

Either way 4chan is too big of a target to fuck around with, safer to just axe it for a day.
>>
>>110126094
picking 256 would have been perfect. adding layers to the saar *****tion
>>
>>110127307
Unless you use http/2, it doesn't matter really. The php one was a remote triggered race.
I say h2 because brotli is required for header compression because Google.
>>
>>110126168
Kiwifarms had their site up and running in just a few hours, RapeApe spent the past day jacking off and outsourcing the work to Indians.
>>
>>110127614
Nevermind. Brotli isn't for header compression. I was wrong.
>>
>>110125539
>>
>>110126807
probably why it took all day
>>
>>110126327
The predecessor (php) to the programming language that runs the internet (javascript) absolutely shat the bed so bad a site written in it can be pwned with no special conditions needed.
Basically:
>is the site reachable?
>is the site PHP?
if yes, get fucked lol.
>>
>Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
https://x.com/eastdakota/status/2113079352682570051
>>
>>110127531
>most shit that worked on 7.4 worked just fine on 8 and 8.1
They're probably running a bunch of old slop code that was originally written for PHP5 and relies on things that got finally deprecated in PHP8. I'm working on updating web apps like that at work right now.
PHP8 is a stricter in general too.
They probably don't have tests or anything that could verify when something breaks, so they leave it alone an pray for the best.
I wouldn't have the balls to run it in prod on the internet, that's like asking to be hacked.
>>
File: 1000024073.jpg (64 KB, 1253x439)
64 KB JPG
>>110126167
bots constantly hit my site even though it's not php, curl costs nothing, hook it to bend and run on a bog standard nvidia with cuda and assign each route to a core and you've got yourself a nice little runner there
>>
Anyone see any pornsites go down? Just saw my first that redirects to some ad
>>
>>110127746
that doesn't look any different from 5 years ago when I bought a domain name for a server that did nothing except log and drop requests
>>
>>110127681
pop a php site with it and show us. go ahead.
>>
>>110124972
TypeScript won.
>>
What the fuck did you do?
>>
>>110127480
thats not how this works

4chan runs on ancient php version. For 4chan to do the security fix all they have to do is update the php version. Unfortunately because 4chan was written in ancient php language it was clearly incompatible with new version of php (or else it wouldnt have been down all day) therefore they had to rewrite parts of it to make it compatible with new version. It's like expecting a script written in ancient python2 to simply just work with a python3 runtime. Hope this helps
>>
>>110127825
Won what?
>>
>>110127883
A... New rewrite... In Rust now...
>>
>>110127595
>what does a php hosting provider have to do with php
>>
>>110127898
ohnonononononono
>>
>>110127825
>only 52 out of 361 dependencies have been unmaintained since 2021 award
>>
>>110127929
>is a full-stack cloud for deploying web apps, servers, databases, and more with automatic scaling, monitoring, and security.
nothing about php or php2shell which would do more than just leak environment variables. they were more likely pwned through some of the many slop they serve.
>>
oh the places you'll go
>>
>>110128007
holy kek what a gem
>>
>>110127700
>retards don't know how to detect hosts behind cloudflare and find their real IPs
lol, lmao even
>>
>>110128041
it's typical skid and bot activity. you'll see attempts on boxes not even running php.
>>
>>110128041
assuming they even have real ips and aren't just CGNATed
>>
>>110126666
checked
>>
>>110126798
Oh I see this is from an archive, I was about to flip my shit at the fact that the admin didn't know which version of PHP this whipped shit bucket of a ""website"" is using. God, I wish I were dead.
>>
>>110128069
right. they updated their scripts

>>110128091
true, but even in cloud networks and inside cloudflare you can find shit



[Advertise on 4chan]

Delete Post: [File Only] Style:
[Disable Mobile View / Use Desktop Site]

[Enable Mobile View / Use Mobile Site]

All trademarks and copyrights on this page are owned by their respective parties. Images uploaded are the responsibility of the Poster. Comments are owned by the Poster.