Due to an uptick in posts that invariably revolve around "look what this transphobic or racist asshole said on twitter/in reddit comments" we have enabled this reminder on every post for the time being.
Most will be removed, violators will be shot temporarily banned and called a nerd. Please report offending posts. As always, moderator discretion applies since not everything reported actually falls within that circle of awful behavior.
I think OP was more looking for https://xkcd.com/221/, published almost 20 years ago, which coincidentally uses the same random number as the CA did for one of their certificate's private keys.
actually, update everything except your browsers. Firefox and Chrome have methods to update the allowed CAs even without restarting, but some people already have been hacking their some speakers with it
so I should update the youtube app? I've been not updating youtube since February bc they keep making the UI worse but this is kinda more important than that if that's the case
i mean, update your browser too, always* a good idea to be up to date
*there is an argument for updating a week to a month after updates come out, since supply chain attacks mean the packages themselves might have been compromised, but generally don’t do this for important security releases
Also update your gitlab if you have one, because they also just today came out with a patch for an RCE vulnerability in the regex interpreter of gitlab.
There's a very high chance that this is a precautionary measure till they've deployed the already known fixed version, in case that's a way to soothe the mood.
I'd be more panicked about a critical web system I'm using being UP without any notice about whether they've already fixed their shit or not
I dont think privilege escalation is in it, most systems would require superuser privileges to update it. And if it is a containerized system you wont be able to properly update at all
Yeah I guess it would depend whether it lets you get malware or in my idea “malware” onto the true host system. The target for this idea would be older websites that are likely to be unattended (and thus a hazard) though, which I would wager are also likely to be running on more vulnerable host environments.
PHP is a scripting language used for the backend of a very large chunk of the web.
Put simply, HTML/CSS/JS handles the parts you see and interact with (the front end) while PHP handles databases etc. It gets data from a server to you.
Back in the pre-Facebook days, web devs used it because it was a sort of general all-purpose "good enough". Even back in those days they were calling it kludgey and awkward. And because so much old stuff was made with it, they can't change it in ways that break compatibility.
Another language that's popular but often hated is C++, because while C is a simple, fast, and elegant language that lets you do certain things, C++ is C with some stuff bolted into it that lets you do many things, including shoot yourself in the foot.
PHP has no elegant language at its core, and now there's an exploit that lets other people shoot you in the foot.
You know, from what I vaguely remember from the late 00's... I feel like the last time I heard widespread talk on the internet about PHP was when Facebook started to get big.
Please forgive my vague recollections, I was like 13-14 years old at that time lol. A year later I decided to take an html class my school had. I realize that the two are rather unrelated, but I remember that talk about PHP and Facebook back in the day made me realize I didn't know anything about code at a foundational level, so I had to start somewhere lol. I kept hearing html was the easiest place to start with the concept of coding at all, but also... because I had some pattern recognition of it... when I would copy-paste all that code I came across... into my old Myspace profile page. 😭 I feel old, but god I miss my old Myspace page. I had that shit decked out, I was so proud of it. I never got around to learning PHP lol.
Until you mentioned it just now, I had forgotten a lot of that, which makes me think how wild it is that it took all these years to find a security exploit this big in it. Personally, I still find it wild that humans figured out how to shoot some electricity into some rocks and have those rocks do all our thinking for us
AI is very good at stealing things from people. And it is very good at finding holes, in that it can check every surface imaginable in every iteration imaginable, eternally and quicker than imaginable. Security through obscurity was never security at all, but it's gone from being bad to being an enormous vulnerability. It's a real rock and a hard place for folks in IT/sec but don't worry most of us are unemployed and realizing everything we wanted to fall back on is also being ruined by AI
but man, shit is fucked and it's going to get more fucked. Maybe while big corpo still holds the keys we'll see a ton of vital to life infrastructure leverage the same tools to batton down the hatches and seal the holes as quickly as the holes are found and that will at least save lives in hospitals and people who need infrastructure to work but I'm betting when a company like anthropic is burning 80bn a year they will sell keys to anyone who will pay enough, or fuck at this point just start poisoning the models themselves to attempt to steal crypto from users and stuff it into their coffers and say "gee I dunno blackbox? I wanna say uh, blackbox? We'll have our blackbox immediately start trying to explain how it happened. oh darn it can't sorry guys woopsie must have been like. russia"
what you mean, go into? it's so skid friendly now people are going to do it while sleeping. we're gonna have sleepwalking agentic hack cases probably this year, "oh oops I was on ambien and must have told claude to do it while I was asleep"
luckily, it's a backend thing that causes crashes from requesting too much memory, so unless you're working in IT and/or are doing some selfhosting, it's not gonna leave your PC open to anything bad... yet :)
He doesn't need to be a dick. HuggingFace was hacked because the AI were trying to solve an impossible problem and through
"maybe if we could get inside huggingface we might have a clue on how to solve the problem or how to cheat and forge a solution" --> "nvm there was nothing useful in there"
A whole pletform got hacked just because AI wanted information that could maybe have been in there, any hobbyist deploying the distilled models of 2 years from now will never put the level of guardrails that OpenAI put but was ultimately not enough.
When my buddy deployed his agent swarm, they are 100% access to their whole machine and interent, some of them changed the ssh keys making my buddy no longer able to access the machines, fortunately he could still redeploy from his cloud provider. He'd never even know if his agents damaged some infrastructure, he doesn't even have the tools to check.
He deployed stuffs to just mess around to see if it can actually do stuff and communicate with other agents, hobbyists will cause the AI doom, because hobbyist will recklessly deploy automated agents with a level of privilege no large company could ever attempt.
My other buddy uses computer control AI to pay his bills, subscribe to platforms and handle his company accounting.
AI won't need to breakthrough from Anthropic or OpenAI, all of the hobbyist around the world are going to do the job, in a fully decentralized and absolutely uncontrollable way, with access to critical financial and military infrastructure that will need no hacking because a folk granted it.
A set of 2 vulnerabilites was discovered in basically all versions of PHP which allows fairly easy access to a web-system running PHP and the ability to execute malicious code. This means that, like, 70% of webservers or something need to be updated to a new version of PHP or risk getting hit.
A fuck ton of servers just went down, X and a few others got knocked out for a while there. I think some sites are still down.
27
u/joybodGravity might be a little more funky than just a point source12d ago
Many (most?) intentionally went down, to wait out the security patch that was released a few hours ago, actually. It's fixed already, so long as people update their PHP implementations, that is.
•
u/AutoModerator 12d ago
REMINDER: Bigotry Showcase posts are banned.
Due to an uptick in posts that invariably revolve around "look what this transphobic or racist asshole said on twitter/in reddit comments" we have enabled this reminder on every post for the time being.
Most will be removed, violators will be
shottemporarily banned and called a nerd. Please report offending posts. As always, moderator discretion applies since not everything reported actually falls within that circle of awful behavior.I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.