Upcoming Critical PHP Security Release

samueloph

Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.

Numerlor

Well this is about as bad as it gets, so I guess the internet will get a bit of test and old forums will turn into a botnet

devttyeu

@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late. CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly. Speculation is that the affected subsystem runs before any application code and affects all default installs.

potaytopotahto

Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off

unethical_ban

Rumored mitigation from other HN threads: >Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day... edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway. edit2: https://old.reddit.com/r/PHP/comments/1xb2utu/upcoming_criti... Someone claiming to be a releng for PHP says INI settings won't save you.