Previously submitted with a much better source: https://news.ycombinator.com/item?id=50172041

The text of this is basically unreadable, any amount of human authorship would be better.

That website looks weird - was it AI coded?

It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times.

As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?

I turned the server off on our app until this storm is over.

Man, my experience with php was never good. Every php project I've encountered eventually had a monero miner infecting the machine as www-data user.

Someone uses Claude to role play as a hacker... Yikes

This is, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.

What about servers that run PHP from the Debian repos?

How fast will the repos be updated?

>Steal Everything

>Leave Nothing

Cringe larping skiddie nonsense

.htaccess

<If "req('Content-Type') =~ /multipart/i"> Require all denied </If>

It’s use-after-free where the “use” is execution of arbitrary code. Yeah, that’s pretty bad.

I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.

Can anyone get the sha to match the download? (Given as a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 in TFA)

If I have a PHP site that doesn't require uploads, how exactly do I disable enough of multipart/form-data POST handling in PHP to mitigate this?

If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.

Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }

You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off