Submitted 3 weeks ago by stuner@lemmy.world to selfhosted@lemmy.world
https://www.youtube.com/watch?v=SP7y1h0laN0
This is and update on the php2shell vulnerability and a response to the blog post from lemmy.world/post/53441818 : eliastaylor.com/noexploit/
I guess nearly everybody has installed the patch by now. Even myself :)
Maybe we are going to see “scanner” websites for such patch situations in the future, with a world map and statistics where are how many unlatched servers…
Maybe we are going to see “scanner” websites for such patch situations in the future, with a world map and statistics where are how many unpatched servers…
You mean things that already exist, like shodan.io?
I don’t know. What does it tell about patches on servers (who don’t easily show their internals in such detail)?
I guess nearly everybody has installed the patch by now
I admire your belief ;)
ATM almost 80% of scanned services are still vulnerable. Considering that **About 54% of PHP services hide their version** and are not counted as affected or patched.it doesn’t look too good
Yeah, assuming everyone installed the patch is quite optimistic. But censys probably also undercounts the number of fixed systems, as some Linux distros (e.g., Ubuntu) don’t change the version when shipping security fixes. I’m running the sury.org package which would report as 7.4.33 but has been patched. Still it looks like there’s tons of unpatched services.
Yes, hopefully most people had time to install the updates. And maybe the false exploit reports helped slow down malicious people too.
Don’t people use unattended upgrades? Crowdsec’s WAF Appsec or Cloudfare’s WAF also put up patches that would’ve caught these vulnerabilities before the official PHP patches were released.
Of course, those normally run once per 24 hours, which is a little late…
Oh hey, it’s my comment on HN they pointed to as having anti ai psychosis, ama
stuner@lemmy.world 3 weeks ago
So it seems like it was rather easy for an IT security professional to create an exploit within 24h of the disclosure. Not sure if every script kiddy can do it, but this means that there are certainly malicious people/organizations who can.
Ultimately, it seems to me that the only real choice is to patch our (public) systems ASAP these days.
i_am_not_a_robot@discuss.tchncs.de 3 weeks ago
Besides the problem of people being able to do this themselves, there’s the problem of people who develop and sell, or sometimes give away, exploits. The people scrambling to publish POCs without verifying that they’re demonstrating the right vulnerabilities are unintentionally helping out by making it difficult to find how to exploit the real vulnerabilities. Like what are you supposed to search for “php2shell exploit for real not fake?” You almost need an AI agent in a sandbox to download and run all the POCs to weed out the fake ones until one of them becomes well known.
stuner@lemmy.world 3 weeks ago
Agreed.
Sounds like a good malware vector to target security researchers…