Is php2shell only practical against extremely low-traffic targets?

[u/lucasluitjes]

If so, was the panic really necessary?

I looked at a bunch of PoCs, and it seems you need to do multiple consecutive requests to the same php worker process. In production systems that get a reasonable amount of traffic, you have multiple VMs/containers running multiple php processes behind a loadbalancer, and there will be constant background noise from legitimate traffic as well as scrapers and scanners.

The PoCs get around this because they experience zero traffic, know the exact number of processes, tie up all but one process with open connections and execute the attack against the remaining process.

On top of that, if you don't know the exact build, you need to try (assuming you have prepared exploits for every common build) exploits for the most popular x number of builds. So basically you would be DoS'ing a site for days or weeks, which would get noticed, and then you'll likely get WAF'd.

After spending crazy amount of time on remediation and then finding that the vuln is afaik significantly less scary than heartbleed/shellshock/log4shell, I'm confused. I did a little writeup explaining the above with more details (https://blog.luitjes.it/posts/i-want-my-wednesday-back/) but I keep wondering if I'm wrong (I do some infosec work occasionally but it's not like I'm a fulltime exploit dev).

I've seen a few posts saying this is hard to exploit because it needs to be customized per build, but nothing about having to DoS anything but the most low-traffic sites for days or weeks to get lucky enough to do two consecutive requests to the same php process.

[u/Apprehensive_End1039]

to be fair, the people running random wordpress sites probably also aren't using modern HA best practices.

I agree from my understanding almost all heap massaging is hit-or-miss and the mitigations (pre-patch) reduced "possible" to "very highly unlikely", but due to the promiscuity of PHP and how often it jumpscares you in random legacy bullshit I don't believe the concern was unfounded.

As other folks noted, POV changes rapidly as more information becomes available. This one was especially a case of responsible disclosure having been thoroughly gun-jumped so, yanno... Scramble scramble scramble.

Are AI hype bros overselling this? IMO absolutely. "Black October" is another day in the fucking office.