Hacker News

points by lifeisloving 15 hours ago | 0 comments

The point is, under normal configurations when you're serving the PHP server correctly with table-stakes best practices the server is not exploitable

This was not a scary vuln at all.

[–] literalAardvark 13 hours ago

Under normal configurations the server is highly exploitable.

It's a horrible vuln and I don't understand what's with all the flat infosec society coming out of the woodwork.

The challenge server had vibe coded infra that made it hard or impossible to hack, but it was a configuration that can't be used in production and no one uses ( it was deployed as a PHP static content server instead of a dynamic site generator )

[–] pixl97 11 hours ago

>I don't understand what's with all the flat infosec society coming out of the woodwork.

Ha, while most of these are probably humans that are just being driven mad by AI, I wonder how long before we get AI driven botnets that try to under play any security vulns to give them more time to take over and collect assets for themselves?

[–] 9dev 8 hours ago

Are you sure this isn’t already happening?

[–] Urd- 14 hours ago

Normal configuration of a PHP server is to not run any PHP code and serve a static html file?

[–] lifeisloving 13 hours ago

Where is all the evidence of exploits if most of the webs PHP servers were vulnerable?

This is a seperate chained exploit itself, seemingly executed by a nation stae. There are thousands of exploits infiltrating web servers around the world daily, and they arent php2shell.

You only care about this because it falls into a weird viral narrative about "AI saftey".

[–] literalAardvark 13 hours ago

There's nothing separate about this.

Chained just means they used php2shell to run a local privilege escalation.

[–] lifeisloving 12 hours ago

Was the exploit not dependent on a kernel exploit that was disclosed and patched in may, or am I just hallucinating?

[–] literalAardvark 11 hours ago

Depends which part: php2shell does what it says on the tin: lets you run arbitrary commands as www-data.

If you want more than that you need to chain an LPE. Which are plenty these days sadly.

[–] cowlevel 15 hours ago

Which best practices did you use to prevent exploitability?

And would you stake your bitcoin on it?

[–] devin 13 hours ago

I had a similar take, but I was wrong.

[–] lifeisloving 12 hours ago

How were you wrong? Out of 15k targets scanned they arrived at 25 servers total.