Glowies knew of the PHP exploit 2 months in advance and another critical privilege escalation exploit in the linux kernel was only patched last week.
if your still using PHP, you deserve it
>>110126134That's 70% of the web.
>>110126145And?
>>110126145if you host a website in german hosting. you know which one. they use php for their backend. you know, german are very similar to japan.
>>110126145Good. The web has to be rebuilt.
TGD
>>110126120>2 Months before disclosureHow many are going to fall for this?
>>110126120"responsible" disclosure embargoes used to be 180 days minimum.
>>110126120>there's a big news story about php today, how can we make it about us?
>In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.>To fix the OOM problem, the PHP security team developed several competing approaches, but each came with its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate. The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources.PHP security team has known about the OOM -> RCE vulnerability for over 2 years but never managed to actually fix it until now.What a joke of a product / company.
>>110126120>noo don't leak our exploit how will we farm PR by using it and making blogposts about how our llm hacked company X???
>>110126529There is absolutely no way that this wasn't some mole who secretly works for some govt agency
>>110126120wild to think the internet was and is filled with vulnerabilities and people are using AI right now to find them.
>>110126529so what you are saying is an rce went unpatched for two years and literally nothing happened? that even rank 10 cves are nothingburgers and this is all security theater?
>>110126529It was already flagged over a decade ago lmao
>>110126120Hackers like Linus lost
>>110126577Everything has vulnerabilities, but not everything has found exploits
>>110126577>literally nothing happenedthat we know of
>>110126529>>110126577>>110126582>retards reading LLMspeak and thinking they can add anything but misinformation to the subjectsasuga 4chan
>>110126565>but thanks to millions of eyes looking at its source code open source software is secure!>fosstrannies assured me!!1>they couldn't be lying (or just clueless), could they?!
>>110126664>Wahh they found a bug in the publicly available source code>This must mean trusting people who don't publish their source code is much safer
>>110126562Never attribute to malice what... bla bla blaThey were working on PHP. What do you expect?
>>110126703I never got why people thought occam's razor is a good argument. There is no logical reason to assume stupidity as the default unless you believe you're significantly above average.
>>110126736that's not occam's razor
>>110126120who tf are Glowies ? (im kinda new to 4 chan)
>>11012612060 days is actually not terrible for a disclosure window. Most of my vuln disclosure embargos are 90-120 nowadays. Everybody is swamped.
>>110126702No, it just means being open source provides no guarantee of security, it was never anything more but lunix-trannies wishful-thinking delusion.
>>110126529>What a joke of a product / companyleave personal home page alone
>>110126529if only you knew just how bad things really are.
>>110126120people still use this gen x cancer slop?
>>110126529Wrong, they knew about it for 6 years.https://bugs.php.net/bug.php?id=78876
>>110126836Glow niggers, fbi and other government agencies. Slang for "this post glows" = "This looks like a fed agent wrote this post"
>>110126885wordpress. It's nearly always overkill but at some point the customer is going to want something annoying that can be done with a wp plugin. And you'd have been better off having gone down that route in the first place then redoing everything.
>>110126764It is
>>110126891>usecase for running out of memory?>wontfix closedanyway, they may have known it OOMs and crashes but there's no mention of a possible RCE in there.
it's bad...
>>110126836>>110126923The CIA niggers glow in the dark, you can see 'em when you're driving. You just run 'em over, that's what you do.-Terry A. Davis
>>110127132>You just run 'em overlowkey ironic
>>110126837Was it actually 60 days? I saw videos demoing it days before the patch
>>110127018no it's not occam's razor is about simplicity not conspiracies
>>110127061What people with relevant backgrounds didn't already believe in nation state level attackers with access to bespoke malware? This has been a thing for decades and it gets reported on in the news.
>>110127200ummm sweaty that's a conspiracy theory
Well obvious the fucking botnet spanning 100k ip addresses spamming my websites, trawling for php and wordpress for the past 5+ years just makes sense now
how do retards not know every single d0 sploit you can imagine in even vague concept already stemmed from, existed in, was explored by, or was already perfected by or rightfully abandoned by the United States NSA?what do you fucking retards think dozen/hundreds billion dollars and top-tier & allegied talent buys you?what does fact that gov has their own billion dollar Mythos (current+1) model on their own airgapped hardware tell you?you will not subvert this, they subvert you.US and unironically the kikes over in (((ISRAEL))) are the most capable cyber opponents by far and NOTHING comes close.
>>110127443I fear backdoors in every aspect of python and it's c implementations
>>110127443Yeah I mean the tor network was literally developed by glowies for glowies. It says it right there point blank on the wiki.I'm also now reminded of Pegasus and Pegasus 2 (which still works). A simple device developed in Israel that can plug into any Western phone and get into it. BTW, Apple HQ in Tel-Aviv is in the same building as the company that developed Pegasus. They're literally on the floor below.And with all that taken into account, it's hard to believe that any terrorist attack/assassination is legitimate; or at least not known about. On a smaller level the FBI has obviously known about future mass casualty events and let them happen to restrict our rights as they see fit.It's all so tiring.
>>110126120So this whole thing was another OpenAI ad.Hack the planet initiative.Glowies probably knew this exploit for decades.
