Upcoming Critical PHP Security Release

 (php.net)

133 points | by choult 19 hours ago

9 comments

  • devttyeu 13 hours ago
    @dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.

    CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.

    Speculation is that the affected subsystem runs before any application code and affects all default installs.

    [-]
    • extraduder_ire 11 hours ago
      @dang is a no-op, you need to email him or the hn@ycombinator.com address
  • samueloph 18 hours ago
    Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.
    [-]
    • nullbio 11 hours ago
      It's already been found and shared on X. It's only a matter of hours before untold numbers of sites are hacked.
    • beberlei 18 hours ago
      It was leaked
      [-]
  • Numerlor 14 hours ago
    Well this is about as bad as it gets, so I guess the internet will get a bit of test and old forums will turn into a botnet
  • potaytopotahto 13 hours ago
    Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off
    [-]
    • qingcharles 10 hours ago
      Sadly this says it's probably not enough:

      https://phpc.social/@Girgias/117476477429221001

    • bpbp-mango 10 hours ago
      session.use_strict_mode = 1 as well. some advice around disabling multipart uploads too.
    • EGreg 12 hours ago
      I have heard Kirill Firsov say that, but does anyone even know the vulnerabilities? Could be a meme.
      [-]
      • potaytopotahto 12 hours ago
        Yes its two hanging pointers related to the upload progress handler that can be used for RCE after some heap grooming, disabling upload progress means that the function that contains the vulnerable code never runs.
  • unethical_ban 11 hours ago
    Rumored mitigation from other HN threads:

    >Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini

    It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day...

    edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway.

    edit2: https://old.reddit.com/r/PHP/comments/1xb2utu/upcoming_criti...

    Someone claiming to be a releng for PHP says INI settings won't save you.

  • hanumseous 6 hours ago
    [dead]
  • railgunmerlin 18 hours ago
    [dead]