Hacker News

points by jstanley 15 hours ago | 0 comments

> I'm not sure how "RCE on every PHP server, from anywhere on the internet, no other requirements" could possibly be underblown by anyone

It could be overblown if it's not true. The amount of time it took for anyone to claim the Bitcoin from the supposedly-vulnerable PHP site convinced a lot of people that the vulnerability was not as bad as claimed.

[–] jooops1 9 hours ago

Why would someone send their exploit chain to a random for a mediocre 'bug bounty'. The bounty was later claimed by people who just did It for fun after work for fun with a LLM of their choice quickly.

[–] tkz1312 15 hours ago

wasn't it setup in an unexploitable configuration (not actually serving a php page IIRC?) for most of the time, and then got popped within like 2 hours once fixed?

[–] lifeisloving 15 hours ago

The point is, under normal configurations when you're serving the PHP server correctly with table-stakes best practices the server is not exploitable

This was not a scary vuln at all.

[–] literalAardvark 12 hours ago

Under normal configurations the server is highly exploitable.

It's a horrible vuln and I don't understand what's with all the flat infosec society coming out of the woodwork.

The challenge server had vibe coded infra that made it hard or impossible to hack, but it was a configuration that can't be used in production and no one uses ( it was deployed as a PHP static content server instead of a dynamic site generator )

[–] pixl97 11 hours ago

>I don't understand what's with all the flat infosec society coming out of the woodwork.

Ha, while most of these are probably humans that are just being driven mad by AI, I wonder how long before we get AI driven botnets that try to under play any security vulns to give them more time to take over and collect assets for themselves?

[–] 9dev 7 hours ago

Are you sure this isn’t already happening?

[–] Urd- 14 hours ago

Normal configuration of a PHP server is to not run any PHP code and serve a static html file?

[–] lifeisloving 13 hours ago

Where is all the evidence of exploits if most of the webs PHP servers were vulnerable?

This is a seperate chained exploit itself, seemingly executed by a nation stae. There are thousands of exploits infiltrating web servers around the world daily, and they arent php2shell.

You only care about this because it falls into a weird viral narrative about "AI saftey".

[–] literalAardvark 12 hours ago

There's nothing separate about this.

Chained just means they used php2shell to run a local privilege escalation.

[–] lifeisloving 11 hours ago

Was the exploit not dependent on a kernel exploit that was disclosed and patched in may, or am I just hallucinating?

[–] literalAardvark 10 hours ago

Depends which part: php2shell does what it says on the tin: lets you run arbitrary commands as www-data.

If you want more than that you need to chain an LPE. Which are plenty these days sadly.

[–] cowlevel 14 hours ago

Which best practices did you use to prevent exploitability?

And would you stake your bitcoin on it?

[–] devin 12 hours ago

I had a similar take, but I was wrong.

[–] lifeisloving 11 hours ago

How were you wrong? Out of 15k targets scanned they arrived at 25 servers total.