@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.
CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.
Speculation is that the affected subsystem runs before any application code and affects all default installs.
>Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini
It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day...
edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway.
Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.
Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off
Yes its two hanging pointers related to the upload progress handler that can be used for RCE after some heap grooming, disabling upload progress means that the function that contains the vulnerable code never runs.
@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.
CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.
Speculation is that the affected subsystem runs before any application code and affects all default installs.
Rumored mitigation from other HN threads:
>Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini
It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day...
edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway.
edit2: https://old.reddit.com/r/PHP/comments/1xb2utu/upcoming_criti...
Someone claiming to be a releng for PHP says INI settings won't save you.
Well this is about as bad as it gets, so I guess the internet will get a bit of test and old forums will turn into a botnet
Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.
It's already been found and shared on X. It's only a matter of hours before untold numbers of sites are hacked.
It was leaked
Where?
Here
https://news.ycombinator.com/item?id=50167754
I don't see any details of the vulnerability leaked except "code execution"...?
It got flagged already, can't see it.
Whew! Imagine if the details were documented in the clear on HN for anyone to see.
Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off
I have heard Kirill Firsov say that, but does anyone even know the vulnerabilities? Could be a meme.
Yes its two hanging pointers related to the upload progress handler that can be used for RCE after some heap grooming, disabling upload progress means that the function that contains the vulnerable code never runs.