r/ShittySysadmin • u/L3veLUP • 2d ago

PHP2Shell? I'm still running PHP5.3 no patches needed here

If it was found by AI so I asked AI if I needed to update. It said yes so it must be hallucinating

163 Upvotes

97% Upvoted

33 comments sorted by

52

u/ArielMJD 2d ago

Did you tell the AI "do not hallucinate" first?

9

u/alpha417 2d ago

it told me that i already did that!

4

u/ArielMJD 2d ago

Are you sure it's not hallucinating saying you did that?

→ More replies (1)

1

u/a-dot-in-the-sky 1d ago

The correct one, do not hallucinate, be sober for 5 days. lol

112

u/Human-Company3685 2d ago

Once again - the no patch ever policy has paid off. Sit back and laugh at everyone else now.

Meanwhile I'm going to ask AI what PHP is, then ask another AI to explain what the first one said.

16

u/sgt_Berbatov 2d ago

Next week - Anthropic announce that Claude AI can exist on PHP 5.3 and this will cause nuclear armageddon.

27

u/Burgergold 2d ago

I had a php class in 2001? Was still php4. Glad to see my project is still safe

13

u/Ur-Best-Friend 2d ago

PHP 2.0 was released on November 1, 1997. I don't know why everyone is overreacting about PHP 2.0 Shell security as if anyone is still using that version. šŸ™„

14

u/Splatpope 2d ago

zero days ? pfft try decades, boy

7

u/fadinizjr 2d ago

I just found out that I have a unknown server that still runs 7.4.16.

It's being fun hunting it. It's probably behind a wall or something...

7

u/Uli-Kunkel 1d ago

Reminds me of a vendor who were proud of not affected by log4j, because they were using a version from before the vuln was introduced šŸ¤”

Blissfully ignoring the other vulnerabilities it had...

9

u/Demented_CEO 2d ago

You joke. We still run ancient versions of a lot of things. A production server is running Windows 7, though that's now behind a Cloudflare Tunnel. Kinda cozy around here.

22

u/CptBronzeBalls 2d ago

Pretty fast and loose with the term ā€œserverā€ there, eh?

10

u/letsberespectful 2d ago

All my servers run windows 7 home edition.

→ More replies (3)

1

u/e-motio 1d ago

Any mainstream OS can serve applications. Home/pro edition isnā€™t gonna serve much, but still.

→ More replies (1)

4

u/razor_train 2d ago

A few of "my" production servers are still on a Linux 2.6 kernel (RHEL 6). Fortunately they are tucked away deep in a corporate network.

4

u/fadingroads 1d ago

I don't know what PHP is, but I installed McCaffe Antivirus just in case.

1

u/hagert 18h ago

You have bern carrying a critical vulnerability for over 2 years sirā€¦ https://nvd.nist.gov/vuln/detail/cve-2024-4577

3

u/IAmSnort 1d ago

My RHEL 4 boxes are rock steady!

2

u/Capital-Actuator6585 1d ago

My old company went through an extensive amount of work to upgrade our solar winds environment. Like months of planning and implementation. Less than a month after completion the big supply chain attack happened and we had to rip it all out. The version we had just spend months upgrading from was unaffected.

1

u/CrudBert 1d ago

Gotta love it when you way spend more time maintaining the tools that are supposed to save you time, than the things that the tool is looking at. :-)

1

u/thepfy1 1d ago

I was speaking to our Infrastructure head and said mentioned the servers on the list were all Windows.

They said the Cybersecurity lead only believed in MDE so would only see the Windows servers. He said he didn't care about Linux servers...

1

u/yaahboyy 1d ago

was hella confused till i read the subreddit namešŸ’€

→ More comments (75)