This PHP thing is a huge nothingburger.Sure, you can get theoretically pwned under the right (unlikely) circumstances but I've seen zero proof of it actually happening in the wild to random hosts. Only under very crafted lab scenarios, and I've been researching the exploit myself.>Inb4 jeet nocoder retards screeching BUT SAAAAR If you didn't research the CVE yourself you're not qualified to talk.
Yeah it turned out to be massively overhyped due to the embargo and PHP people saying "no mitigations work you're fucked but OOH I CANT SAY ANYMORE"even with all the LLMs out there, we have no working PoC that don't require LFI
In addition, the only reason half the internet shut down it's because "better safe than sorry"
Bump
It's a very complex exploit that requires a very crafted attack, the people that think it's just a 1 click pwn are nocoders, log4shell was a lot simpler.I was reading on hackernews yesterday "but it's trivial to exploit" , lol what a bunch of morons
It's just a test run for shutting down the internet due to le hackers when WW3 kicks off in full force.
>>110127456>but I've seen zero proof of it actually happening in the wild to random hosts. Well we've known about it for barely two days and all the biggest possible targets preemptively shut down. There are a bajillion websites out there that aren't maintained very well and are going to be running outdated PHP forever.
>>110127609yeah and we all get put in the FEMA camps
>>110127610The thought process is just heap corruption = possible RCE. That's all there is to it. How difficult it is to turn that heap corruption into an actual RCE is a problem for the attacker (and it's a lot harder than people are making it sound), but not something the defender should just leave lying around.
>>110127456it happened to sites I know though
>>110127636It's actually complex as fuck, it's a very crafted attack under real world scenarios. Very high vector.
>>110127665Name one.
>>110127622That's like 2010 shit, you gotta update your lore
>>110127670I'm not saying it isn't. It's a 6 year old vulnerability at this point and if it was easy for some script kiddie to exploit the internet would have been broken long ago.All I'm saying is that you don't typically want an exploit to have to reach that level of severity before you take action if possible.
>>110127716FEMA still exists & they'll still gain impunity to do as they wish when the government says so.
>>110127720Yeah I'm agreeing with you
>>110127636If we look back at this in a year or two and no has figured out how to exploit this in a meaningful way then fine, we all wasted our time. But as things stand, it's not worth waiting.
>>110127456You are a braindead nigger with high time preference. Kikes don't hack things and immediately deface the landing page with cuck porn and announce how they did it. They gather info to blackmail people with later or drop anonymous tips to their cousins in regulatory agencies they may not act on for years.
>>110127742It's not so much that you can't exploit this in a meaningful way but it needs to be a highly targeted attack where you need a lot of information on the specific system you're targeting at the very least to have a chance of pulling it off. Either way, I'm not disagreeing. The bug was patched anyway, no point leaving systems vulnerable.
>>110127763And you're a braindead nigger who hasn't done a single second of research and parrots shit he reads online.
>>110127609>>110127622there's literally nothing that either of you can point to that suggests those things are bad
>>110127466>>110127456IT security here. What you guys aren't getting is i got to make a big show of how "on top" of it i was and hyped the fuck out of it and took down all affected sites before everyone else and got to boast about how early we were as an organization to get ahead of it and patched everything to keep us safe and sound and that's a huge plus to leadership who won't know any different.Easy win.
>>110127782WW3 isn't bad? Okay, Schlomo.
>>110127763we were told this was the easiest thing ever to exploit and instantly the web would be overrun with script kiddies taking down every PHP site, you'd think at least one of them would deface some sites for yuks
>>110127787success has never looked so easy like srrsly there i was before any multinational implementing waf rules and disabling session.upload_progress.enabled in apache ganggang fr fr>>110127802that's like your opinion
>>110127456>nothingburgergo back to plebbit, you pimply faggot
>>110127826I never disabled session.upload because I don't listen to redditors. Also, did you have a seizure while replying to me?
>>110127787Yeah easiest job-justification win this year. We were following the development of the threat landscape, deploying mitigation strategies as son they appeared before finalizing the complete vulnerability migitation.
>>110125539 here. still laughing at the (You)s i got from nocoders and skids.
>>110127840php recommended disabling session.upload or did you not know that
>>110127859kek
Oh we're back.
>>110127868I knew that. I also knew by 8PM last night that it wouldn't make a single difference since the bots would be written to compensate for it since it wasn't an actual prevention measure. Patching was the only fix (OR DID YOU NOT KNOW THAT?)
makes me giggle when I remember on hackernews last night that this attack was "trivially easy" lol why are people so fucking stupid, it makes me sick
>>110127905listen if measures that would later be recommened by php as a means of mitigating the attack were implemented before php recommended them then that bolsters the original point that you made you fucking retard
>>110127916Getting the bug to happen seemed simple enough. Actually putting that to malicious use needs more effort, where I suppose it is kind of a matter of time until someone does something with it, probably on some long forgotten website or blog.So not an end of the world event, but definitely an oopsie.
>>110127941OR.. I tell leadership those recommendations are meaningless and won't do anything to protect us then they know I know my shit and don't question it, which is exactly what happened (RETARD)
>>110127964Simple enough under a controlled lab environment, quite complex in reality
>>110127973how would laymen know you know your shit just because you said so as opposed to php. they'd be more inclined to trust a large organization over some retard who can't track an argument. also your iniital point assumes that all surfaces of attack were done by the same person. that's nonsensical. you're an actual retard.
>>110127983Sure. Still, if you're running PHP, no harm in updating. Just the sort of stuff IT people can use to justify their jobs.
>>110127996Because you've never worked a day in your life and every reply makes that more and more painfully obvious.
>>110128020I agree. No reason to leave potential exploit vectors around. But makes me laugh and seethe to see people parroting stuff they read online without a shred of understanding.
>>110128032again idiot it's not whether they did or did not believe you but rather what would bolster your original claim more. god you're fucking retard.
>>110127456https://www.youtube.com/watch?v=pfWZrdzvooc
>>110128047My track record bolsters me. I'm a god to these people. A maker of fortresses I'm the builder of walls which keep them safe.And you're still unemployed. Lmao!
>>110128060>localhostRETARD
>>110128060i can't believe 127.0.0.1 was hacked...
>>110128068This is the kind of stuff I'm talking about. Retards will see stuff on a screen they don't understand and GO WOWZIES Why are people so low iq?
>>110128045I'm not exactly a PHP or web dev guy, so I just glossed over the details, but I've had enough experience with memory shenanigans that I was like, oh. Yeah, that's kinda bad, but how to do you turn it into an attack vector?Thankfully, in my case such memory issues usually just mean memory leaks, leading to an eventual crash if memory happens to run out. User maybe losing some work and filing an angry bug report ticket to us. An annoying thing to try to debug, but that's software dev for you sometimes.
>>110128060holy shit 127.0.0.1, that's MY computer, HOW DID HE HACK ME
>>110128064Well you have the how to,now go do it in the wild champ
>>110128099that's the thing, you can't just do that, it's not a generic exploit like log4shell, you need a specific set of unlikely conditions
remember when spectre dropped and everyone pissed their panties because of a PoC where the attacker and defender were running in the same vmem space?
>>110128089>HEumm please respect xer pronouns
>>110127540hackernews is nothing but corpo trash web "developers" acting smarmy and getting angry at the very small minority who posts there for getting smarmy right back with them.
so you're telling me the Almighty Super Intelligence can't figure it out by checking the git diffs?. meatbag researcher no need to apply, your context size is 4096 at most
>>110128269We already know how and why the exploit happens and how it can be recreatedIt's NOT a generic exploit. It CAN NOT be used unless your target meets a very specific set on circumstances
Can someone explain to me why a php update took so long to apply?
>>110128152>ALL YOUR INTEL AND AMD IS DIED GO BACK TO CYRIXgood times
>>110128152Spectre was an even bigger meme because it didn't even allow for writes.
>>110128308Most likely, incompetence by the 4chan dev team
>>110128285cope harder. phpoocalypse are here and it's just keeps proving why clankers are better than niggers like you
>>110128328Cope about what?
>>110128336in five minutes the internet will explode
>>1101276094 was the test run> cert revokedwhat a coincidence all sites use "https" now
>>110128372are you implying that our attitudes are determining behavior that generates patterns which can be managed and arranged according to social events?
>>110128360STILL HERE
>>110127456Unless we can take the exploit, give it to Gemma, and it can pull it off on a vulnerable site, it's a huge nothingburger.
>>110128308What I want to know is why it took PHP so long to tell everyone what versions were affected which made everyone freak out and freeze everything and wait for a day instead of just updating immediately
The ai gon hack us n sheeit
>>110127456> Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings.so they are lying here?
>>110130005Because they don't need to provide proof.
SAAAR DO NOT REDEEM eMUDrha mudskin POOJEET CRRTIFICATE
>>110127456The nodejs exploit released at the same time sounds like a larger issue.
>>110127787>>110127855son
>>110127456>you're not qualified to talk >uh-huh I haven't seen anythingCloudflare has said they've literally seen it being exploited in the wildWho the fuck are you? Some retard who posts on image boards
>>110127475I worked for a company that had a PHP-based healthcare application. If I was working there and worked in that team, I would absolutely fucking pull the plug immediately. If the risk is that someone can get a shell open and start dumping data, I’m taking that fucking eight hour downtime.
>>110127636>The thought process is just heap corruption = possible RCE.Didn’t the PoC specifically show that it was RCE? The bug itself was reported like years prior, but the core developers didn’t find a plausible RCE vector in it then and it wasn’t prioritised.It’s just that the PoC had weeks/months, not hours/days.
>>110129081They wanted to do a coordinated release so that every vendor that ships PHP would update at the same time and leave as little time for attackers to try to make exploits based on it.But one of the AIslop security firms decided to leak the PoC video ahead of time, leaving everyone scrambling.
>>110127636>heap corruption = possible RCEIf you have heap corruption, you should assume RCE is possible as a matter of course.You do not sit on your hands and wait until RCE is demonstrated.
>>110130772You're supposed to work with vendors privately and have them quietly ship updates so that people will have already updated by the time you announce the vulnerability and all of North Korea starts hammering away at it
>>110130863>You do not sit on your hands and wait until RCE is demonstrated.Yes, but that's not the argument being made.
>>110130863>You do not sit on your hands and wait until RCE is demonstrated.That is in fact what the PHP devs did.
>>110130649I like this Lain.
did a SINGLE website get hacked? like, ONE?
Perl won
CVE-2026-109618 (OOM corruption):>Only fully validated against Apache mod_php with the prefork MPM — not event MPMs, and not PHP-FPM.>For PHP-FPM (which is what most modern deployments), PHP's own analysis says it's "likely susceptible" but no complete exploit has been shown. >The attacker must defeat ASLR to find valid memory addresses for the forged structures: non-trivial additional step. >The request must be sized to fail allocation at exactly the right moment. CVE-2026-109619 (stale global state):>Requires two requests hitting the same worker process — the first leaves stale state, the second reads it. >On PHP-FPM, it's explicitly conditional: it needs a fatal error in the application plus the upload progress path, or a frontend sending PHP_VALUE settings. >The session upload progress path is one confirmed trigger, not the bug itself (the initial leaked writeup misidentified both vulnerability classes). Exploitation status:>No confirmed successful exploitation in the wild as of the latest reports. watchTowr reproduced CVE-2026-109618 but reported no in-the-wild exploitation.>No reliable public PoC exists (per Elastic Security). >VulnCheck's canary hosts observed upload attempts but they "were not enough to force memory exhaustion in one request.">Neither CVE is in CISA's KEV catalog.
>>110132052doesn't even matter anymorethe public saw AI bring the internet down for 6 hours and will invest $2T without complaining
>>110130745Is the risk any different before and after the bot hallucinated an exploit?
>>110127456Got this in nginx logs today, yay.85.11.167.243 - - [00/Oct/2026:00:00:00 +0000] "POST /index.php HTTP/1.1" 000 0 "-" "php2shell-000000"
85.11.167.243 - - [00/Oct/2026:00:00:00 +0000] "POST /index.php HTTP/1.1" 000 0 "-" "php2shell-000000"
>>110127609yeah fuck the new world order, fuck the sabbateans and their pedo masonic rituals, fuck fiat currency and the rothschild family
>>110127456You just described 99% of CVE-slop It's all just resumé padding for "security" fags
>>110127456It is a nothingburger, but our site was shut down for like a day and that inconvenienced us 4channers!It's all you will hear about for at least a week
>>110128185>corpoyou played that polish tranny game. just say corp. it's even 1 word less and you don't seem like a tranny
>>110132388probably fake, no fucking way an attacker would let the user agent specifically say php2shell.
>>110127456At workplace we were so done with how functionally useless builtin multipart parsing was we made a framework that has apache lie to php in order to disable it and then analyze post body manually. I do wonder if standardized attacks would work on our stuff.
>>110133889That honestly sounds great and is something I'd always wanted. Can you share that?
>>110133912Just open php://input magic file and parse it, that's not really magic.
>>110130726>BUT GOYFLARE SAID!!!!!GOYFLARE said PAYLOADS were being sent, doesn't mean they actually work you fucking RETARDAlso fuck GOYFLARE what are they, internet's babysitter?
>>110133159a retarded skid using vibecoded "test client" to get around claude security policies would
>>110127456so this is nonsense? I am confused some people claim its world ending others say its not easy to use.https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
>>110135186yes, that's ai slop nonsense. that pocalready assumes that you own the server and can do lfi.
>>110134996You sound like a rational and totally welladjusted individual, everyone should definitely listen to you on technical matters
>>110134996>what are they, internet's babysitterThey sure think they are.
>>110132590something like that but based
Is PHP just le bad and we must RETVRN to our true heritage?
>>110134996these institutions are trustworthy with a big T but not in linguistics, in meanining. so why the holdout, what's stopping you from believing them?
>>110137314Doubting institutions is the cool thing to do now, anon. We're returning to monke. Such is our fate.
>>110137233Can we still do that, code a web form in C? How would you even get started?
Let me get this straight: Foundational technologies are now completely at the mercy of AI slop code. They will all be rewritten by LLMs, and nobody will understand them any longer.Wonderful.
>>110127610>There are a bajillion websites out there that aren't maintained very well and are going to be running outdated PHP forever.Nobody visits those.Literal nothingburger.
>>110137874You can code a web form in C but considering that any kind of string manipulation in C (which is 90% of a web app) is an incredible pain in the ass that can easily cause vulnerabilities, it's a bad idea.You can write your own string library that doesn't use retarded shit like null termination but that's also really inconvenient to use.
>>110127456I can understand legacy software in PHP, but imagine starting new projects on that shit
How come nobody ever finds any WebAssembly vulnerabilities?
>>110137233>reduce the amount of time I had to spend programming and maximize the output and get the solution quickerNo good thing EVER came from such mentality
>>110131499no lmao
>>110127787This fat cunt gets it. If you haven't said "and we spring into action to protect the org" this week, you are NOT getting a fat raise this year
>>110139089WebAssembly *is* the vulnerability
>>110139036>I can understand legacy software in PHP, but imagine starting new projects on that shitWhy wouldn't you start a new project in it, considering you have 1 billion different reference functions that you can use? Shit, I once wrote a video demuxer in php.
>>110127840hey how about you suck my balls >23 Oct 2026 — Informational advisory: Session upload progress>We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.https://www.php.net/
It still needed patching, you fucking idiots. What are you even saying?
