"No successful PHP2Shell exploits seen so far"... in the wild, specifically in Wiz's honeypot. The vulnerability itself has been successfully exploited, most notably for the "Steal my Bitcoin" challenge [1] as one example.
Dan Guido, of Trail of Bits, claims they have an "universal" exploit [2]. Knowing their track record, I don't currently have a reason to doubt this claim.
EDIT: The HN title has been changed since posting this comment.
slowin•40m ago
Wiz is an Israeli company, they're not credible.
paxy•36m ago
It's funny that when stealmybitcoin.com was posted on HN (https://news.ycombinator.com/item?id=50224916) there were hundreds of top voted comments saying "see no one has been able to steal it, the reported vulnerability was fake, it's all AI marketing" etc.
Since it was successfully exploited there has been zero further discussion, and I bet most people who participated in the original thread aren't even aware.
ForHackernews•29m ago
Two things can be true:
1) A motivated human eager for $500 and internet cred can exploit a vuln (perhaps using AI tooling to help)
2) The vuln is not easily exploitable at scale by driveby bots.
NitpickLawyer•21m ago
IIUC, the first setup couldn't be exploited because the site didn't run any php. You kinda need the server to run some php if you're gonna use a php vuln. It got solved ~2h after they added a php-version.php ...
syshyk•13m ago
The main kickback was against the hype and it was "so easy for AI" and would take "15 minutes to compromise everything".
Either way, this was not true.
nubinetwork•34m ago
Just last week companies were saying php2shell has been rampant for months, but if that were the case, wouldn't we all have strange errors in our logs? Something seems fishy to me.
jagged-chisel•31m ago
Should we expect logs from a compromised system to be truthful?
minitech•17m ago
Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”.
xx_ns•44m ago
Dan Guido, of Trail of Bits, claims they have an "universal" exploit [2]. Knowing their track record, I don't currently have a reason to doubt this claim.
[1]: https://stealmybitcoin.com/
[2]: https://news.ycombinator.com/item?id=50226010
EDIT: The HN title has been changed since posting this comment.
slowin•40m ago
paxy•36m ago
Since it was successfully exploited there has been zero further discussion, and I bet most people who participated in the original thread aren't even aware.
ForHackernews•29m ago
1) A motivated human eager for $500 and internet cred can exploit a vuln (perhaps using AI tooling to help)
2) The vuln is not easily exploitable at scale by driveby bots.
NitpickLawyer•21m ago
syshyk•13m ago
Either way, this was not true.
nubinetwork•34m ago
jagged-chisel•31m ago
minitech•17m ago
I don’t suppose you’re thinking of when the issue was discovered? That was August 1st, according to https://calif.io/php2shell/#the-discovery.
nubinetwork•11m ago
minitech•8m ago