points by Urd- 13 hours ago | 0 comments
Normal configuration of a PHP server is to not run any PHP code and serve a static html file?
[–] lifeisloving 12 hours ago
[–] literalAardvark 11 hours ago
There's nothing separate about this.
Chained just means they used php2shell to run a local privilege escalation.
[–] lifeisloving 11 hours ago
Was the exploit not dependent on a kernel exploit that was disclosed and patched in may, or am I just hallucinating?
[–] literalAardvark 9 hours ago
Depends which part: php2shell does what it says on the tin: lets you run arbitrary commands as www-data.
If you want more than that you need to chain an LPE. Which are plenty these days sadly.
This is a seperate chained exploit itself, seemingly executed by a nation stae. There are thousands of exploits infiltrating web servers around the world daily, and they arent php2shell.
You only care about this because it falls into a weird viral narrative about "AI saftey".