It's things like "under the attacker's feet" which completely throw me off. While trying to parse the text, my brain tries to imagine a surprised hacker.
Yeah but this AI music is worse than any AI produced code. They're both awful but I really lose all respect for people who think these Sumo songs sound good. Wow I hate that AI musician voice so much.
I just wrote almost the same thing (I start to write my
comments before I read what others say, so that it is not
influenced directly what I write). I am glad to come to the
same conclusion - this website is both visually interesting
as well as very annoying.
I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.
You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.
I can literally feel my eyes physically defocusing trying to read this, and I can’t help but conclude that, at a level below conscious thought, my brain is trying to defend itself from AI-generated text. Perhaps it is more of a cognitopoison than I explicitly knew.
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch :
if ($http_content_type ~* "multipart") {
return 403;
}
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases :
session.upload_progress.enabled = Off
How is this a better source, the current post is a PoC? This is just a warning...
You're not even reading the things you're saying are worse, and reccomending things that arent what you say they are (because you didnt read those either)
Announcing this thing and then putting an embargo on the fix for 24 hours is by far the most irresponsible thing internals has ever done and I have seen them do some insane shit in the past 20 years.
It is visually interesting but also annoying. I hate to
admit it, but as I grow older, I may get dumber and I
much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages
have not yet all fixed existing bugs. Has not AI been used
to find bugs or assumed bugs? Why are bugs found in old
code still?
Why would they hand code a website for an exploit that they probably found 15 minutes before and will be fixed in a few hours? The copy should have been better though.
The text of this is basically unreadable, any amount of human authorship would be better.
It's things like "under the attacker's feet" which completely throw me off. While trying to parse the text, my brain tries to imagine a surprised hacker.
LLM or Engrish? Reminds me of “thumb rule”.
It reads like the average PR summary I had to review every day. ‘Had’, because I stopped doing that after being blessed by LGTM https://m.youtube.com/watch?v=3TNpOD6bov8&pp=ygUEbGd0bQ%3D%3...
Yeah but this AI music is worse than any AI produced code. They're both awful but I really lose all respect for people who think these Sumo songs sound good. Wow I hate that AI musician voice so much.
It really reads like it was passed 3 times through Claude.
I just wrote almost the same thing (I start to write my comments before I read what others say, so that it is not influenced directly what I write). I am glad to come to the same conclusion - this website is both visually interesting as well as very annoying.
The font is terrible on mobile, cannot tell then difference between a comma and a fullstop at all
yeah agreed.
I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.
This may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.
You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.
I can literally feel my eyes physically defocusing trying to read this, and I can’t help but conclude that, at a level below conscious thought, my brain is trying to defend itself from AI-generated text. Perhaps it is more of a cognitopoison than I explicitly knew.
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
Previously submitted with a much better source: https://news.ycombinator.com/item?id=50172041
This one claims to actually be an exploit. The other was an announcement from PHP without details.
How is this a better source, the current post is a PoC? This is just a warning...
You're not even reading the things you're saying are worse, and reccomending things that arent what you say they are (because you didnt read those either)
Someone uses Claude to role play as a hacker... Yikes
I turned the server off on our app until this storm is over.
Yeah, the circuit breaker is the best firewall!
If I have a PHP site that doesn't require uploads, how exactly do I disable enough of multipart/form-data POST handling in PHP to mitigate this?
Block it at your web server before it reaches PHP. Ctrl+F "nginx" or ".htaccess" in this thread for configs.
Can anyone get the sha to match the download? (Given as a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 in TFA)
Man, my experience with php was never good. Every php project I've encountered eventually had a monero miner infecting the machine as www-data user.
It’s use-after-free where the “use” is execution of arbitrary code. Yeah, that’s pretty bad.
Announcing this thing and then putting an embargo on the fix for 24 hours is by far the most irresponsible thing internals has ever done and I have seen them do some insane shit in the past 20 years.
.htaccess
<If "req('Content-Type') =~ /multipart/i"> Require all denied </If>
What about servers that run PHP from the Debian repos?
How fast will the repos be updated?
On Reddit they stated that Ondrej is aware of the issue
That website looks weird - was it AI coded?
It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?
Why would they hand code a website for an exploit that they probably found 15 minutes before and will be fixed in a few hours? The copy should have been better though.
Because it takes less effort to paste text with basic readable formatting than doing this awfulness
Well Heartbleed and Shellshock had nice looking sites so we kindoff expect better?
They had more time to prepare
>Steal Everything
>Leave Nothing
Cringe larping skiddie nonsense