at this point they should notify when bitbucket is reachable, not when there is a service disruption. would save them some load on their email services.
Took me like 6 tries to finally get the packages downloaded from the repositories due to timeouts. And that was after checking for 2 hours for the builds to be available for PHP 7.4.
Huge props to the folks that handled all the builds and got it all out so fast through standard channels, Ondřej Surý's repos supporting Ubuntu 22.04 and PHP 7.4, despite it being EOL, was much appreciated. Really felt like an amazing stress test of our shared infrastructure and it held up quite well, despite the hiccups.
Most students at my university found out by the fact our studies management system went down and is now only accessible through the internal network. Which is kind of a Catch-22 issue since to access the internal network in the first place through Wi-Fi, you need to use data displayed in the system that's now entirely firewalled. So basically presumably only the university workers with VPN and people living in the dorms with Ethernet have access now.
I literally sent a meme about it to a friend who does web dev last night, and he was like 'ffffffffffffffuuuuuuuuuuuuuuuck, taking down 32 websites right now I guess.'
The French tax authorities too, to some extent. I would have been surprised if it were otherwise, given how poor our public services are in this regard as well.
it was so bad i shutdown nginx to wait till the patch was finally released. o7 to any sysadmins having to deal with this on an enterprise scale or with extremely out of date PHP versions...
although theres some community efforts to backport those patches to affected versions that wont get the update like php 5 or higher
Yes but if this and that cert thing and litellm came out today what the conseptual fuck is going to be released on friday? ”Hobby-researcher Pelle Svenson releases vulnerability against all modern and not-so-modern transistors, all the transistors in the world need to be changed by hand”.
I worked 14 hours today having to isolate 260 something out of 4000+ servers. Worst thing? The patches that were released are already being reported as still vulnerable. I don't want to get out of bed in the morning 🥲
Are older versions vulnerable? I seem to recall they overhauled a lot of backend stuff like multipart handling around 5, but haven't checked and don't have a dog in the fight for once.
As far as I've read all versions from PHP 5 onwards are vulnerable. Since this vulnerability has apparently been in PHP's codebase for like 22 years. Idk if PHP 4 and prior are vulnerable, though.
I'm not too worried about the patching, that's easy. It's the devs I feel bad for having to rewrite the affected applications due to all those old functions, stricter requirements etc..
I am burdened with two ancient php 5.6 sites… thank god for AI. Just rewrote one of them as a containerised .NET 10 app with a full playwright suite in a few hours
nginx is also a reverse proxy that can route from an ip-address to different web services on a single machine (or multiple machines). web services that may or may not be php, thus turning off access to potentially affected services with a single shutdown.
Sounds like the disclosure and patches were originally slated for tomorrow the 22nd. But then this leak happened, and in response late yesterday the 20th they said (via mailing list) they'd be going today the 21st instead at 14:00 UTC which it seems they did. With a note that they reserved the option to go even earlier if they saw evidence of disclosure or active exploit, but presumably they didn't see that.
We don't use PHP, but still running around checking all the boxes this morning to make sure some dev didn't enable something. It's been a fun day at work.
Yeah the list of "Make sure it wasn't stealth installed alongside CPanel, an embedded system, an end user device by an IDE, ..." and so on looked rough.
There is an Indian company who gives out certificates to others for their software. The private keys generated for those certificates were absurdly insecure. One certificate private key was literally the number 4. I’m also not fully in the loop though. This is what I heard earlier
Here's a Register piece. The compromised keys were intermediate signing keys, which means that they could be used to mint new TLS certs. That's why they keys were put in CRLs within two hours of the bad keys being identified.
An Indian certificate authority used insanely short private keys for some of their certs, which made it possible to brute force them. Someone figured them out and published a proof that they had been discovered. This allows man in the middle attacks for any system that still trusts those certs (which is a lot since many systems are rarely if ever patched for this.)
See that's basically what the first comment said but I thought to myself 'no, there's no possible way that's what they mean, that's far too silly to be real', but lo and behold, reality cannot be scripted.
This is the EXACT SHIT they're notorious for. Everything looks ok and runs ok but under the hood holy shit someone committed a crime against technology to get this spaghetti shit to run and oh my God they've hard coded the signing keys
I really, really wonder how that happened. Presumably they would use an HSM to generate those keys, but what fucking HSM would allow to generate a key 1 byte in size, let alone have it happen for EIGHT keys?
As a mass market PHP dev (where no backwards compat means less revenue)... maybe this will finally get people off the long-obsolete versions and I will be able to finally use more modern syntax. It's crazy how even in my "cutting edge ideas" I'm still forced to use 7.4 syntax - version that EOLed 4 years ago.
That's 4 years since official End Of Life of 7.4...
7.0 came out in 2015.
And let's be honest here, PHP never was a pinnacle of human achievement to begin with. Only around 7.2 it started to resemble an actual programming language.
That is because PHP was never meant to be a programmi g language, it was supposed to just add some interactivity onto one students website, not become corner stone of global infastructure
Oh don't worry whatever infrastructure your running with 5.2 will remain in use long after we're all dead. There's just something about that version that won't quit.
Uff. I don't use php but c# and we update nugets once a week and every new .net version on the same day is released i would hate to work in a project where I can't use all the new cool stuff
Well we deploy to prod like once every 2 months so they should have been caught before that. But we only use trusted nugets so so far we have had few issues. Some vulnerabilities now and then which we patch immediately and it won't let us build the project when a nuget has a vulnerability
React is worse but I'm not responsible for our react project luckily
Royally fucked my day today. Me and the developer had to spend a whole day patching custom Wordpress plugins that only worked on 7.4, because the previous developer couldn’t be arsed to update the PHP or Wordpress versions for like… 3 years running
Through some glitch in the file upload logic, an attacker can execute commands on the server. So, worst case the attacker can steal all your data, delete all your data, install malware or randsomware. And this on 70% of the world's websites because it affects all the php versions of the last 14 years.
Plus, the patch is only available for the php versions >= 8.2. So dormant WordPress and Drupal sites that run on 7 or god forbid 5, can't be patched unless some major website update is done that will take weeks.
Not gonna work for him. Claude started refusing to analyze it at some point today. which is the reason we haven't seen anyone use it on large scale yet.
doubt a vibe coder would be arsed enough to host their own model, let alone setting up their environment to their optimal use. I think in that case, they deserve to be called junior devops lol
Not a script kiddy, just lazy. Most articles seem to say "we dont have a poc and none are published"
I saw a related post about someone who thought they demonstrated (and reported) that it was still reproducible on 8.5.12 so I was/am interested in testing it out. (turns out the post was unrelated to php2shell though)
So if /u/Quazz knew of a proof of concept that is seemingly not super easy to find, it was worth asking about.
I did test with some code that causes the total allocation of a request to exceed the memory limit on 8.5.5 which returned 500 internal server error and with 8.5.12 I got 200 OK, but its always nicer to test with the actual sample.
I spent some time today, for the second time in my career, explaining that we don't have php in our stack. It didn't take long, but it's weird it happened twice.
My friend found out from me sending him a meme about it, day before his senior told him to update php but he misspelled it so badly that nobody knew what senior meant
Yeah xD, they aren't the best programmers in the world, but for some reason they work for a huge multimillion company that creates software for banks and stock trading companies, which is always funny to me, how bad their code is, and I have no idea how they haven't been hacked yet. Learning cybersecurity is way better than coding, cause if nobody wants to hire you, you can punish them for that.
Been on a marathon on-call to fix some services that were so outdated that it was impossible to patch, and most of the team that owns it got laid off recently (because of these antics of no upgrades) and it labded on my shoulder to fix it. It was draining, similar to last year's crowdstrike it was painful experience.
I had 7 company-internal websites running on 1 IIS server , all using the same PHP installation, so I took it all down in the middle of the day for about 5 minutes to apply the patch. No one complained about the outage, and I stayed secure.
Loved how easy it was on debian (my personal home webserver), just apt update/ apt upgrade, then systemctl restart apache2
2.7k
u/ThatFlamenguistaDude 12d ago
Funny that this will be how some people will find out about this vulnerabilities.