Chained PHP2Shell exploit roots 25 servers, including US Government servers

tensegrist

perhaps i was wrong https://news.ycombinator.com/item?id=50272530

lunargamma676

Same here, though what stuck with me is that a firewall's admin PHP page was reachable from the internet at all, keep that on a mgmt VLAN.

athrowaway3z

> A1 — Memory Exhaustion (~383MB): I'm actually somewhat surprised at the clumsiness here. I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it. DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - https://github.com/KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests. Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.

codegeek

I am confused. Is this attack possible even after the PHP patches OR these servers just didn't patch ?

xxmarkuski

Dream is btw founded and led by Sebastian Kurz, who was head of the Austrian government. He had to step down because of a corruption scandal.

jvandijk

Haha woopsie

bix6

It sounds like multiple things were misconfigured on these servers and they still have access?!?

tamimio

Firewalls are likely fortinet

paxy

Now let’s watch the goalposts shift in real time about how severe this vulnerability is.

colemannugent

Reading this I'm almost certain the firewall vendor is Palo Alto Networks. They included a PAN-OS setting verbatim and the SELinux config matches my experience.

npn

> Claude Code had been installed I just do not understand. CC is not the sole harness in the world, why the attackers insist to use it.

brcmthrowaway

With software being fundamentally unsafe I see everything hardwired in chips. FPGA stocks? DV is about to become hot again..

loeg

> For security purposes, we are not disclosing the vendor or the affected versions Wat

j45

Wild, I hope the challenge on HN didn't contribute to this.

jakobdabo

> the attacker chained in a second exploit: a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem Linux seems to have a huge attack surface that doesn't necessarily need to be there for every user/server. E.g. this came out today: CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation [1]. I just disabled mptcp on my systems since I don't use it. Why was it enabled by default? Can I disable this XFRM thing too? [1] https://www.penligent.ai/hackinglabs/cve-2026-98432/

mentalgear

Maybe we going to have to shut down the Internet soon. Maybe it won’t be such a bad thing to become more local and decentralized again.

fierycatnet

That's wild, I remember in early 2000s it was super easy to upload a PHP file with a shell. Back when hostings were shared, one shell could get you access to the whole host.

genxy

I thought we were smug about how hard it was to make a working exploit for this?

jtchang

Why are there any management interfaces exposed to the Internet at all?

mrdootdoot

Hi all. Reading these every day now. Is public cloud safe anymore or the internet in general? Or are we just choosing to live in a reality where their mondo security budgets head off these exploits - and yeah, naw - coming clean is still more expensive than burying incidents? Edit: “Or the internet in general” - and yes internet was never safe but this is just next level. You seem to do everything right and it doesn’t matter. Is o365 really safe for example? I’m rapidly seeing my faith in SaaS platforms degrade - they can’t be immune to all Of this