Submitted 2 hours ago by stuner@lemmy.world to selfhosted@lemmy.world
https://www.youtube.com/watch?v=SP7y1h0laN0
This is and update on the php2shell vulnerability and a response to the blog post from lemmy.world/post/53441818 : eliastaylor.com/noexploit/
I guess nearly everybody has installed the patch by now. Even myself :)
Maybe we are going to see “scanner” websites for such patch situations in the future, with a world map and statistics where are how many unlatched servers…
Yes, hopefully most people had time to install the updates. And maybe the false exploit reports helped slow down malicious people too.
Maybe we are going to see “scanner” websites for such patch situations in the future, with a world map and statistics where are how many unpatched servers…
You mean things that already exist, like shodan.io?
I don’t know. What does it tell about patches on servers (who don’t easily show their internals in such detail)?
stuner@lemmy.world 2 hours ago
So it seems like it was rather easy for an IT security professional to create an exploit within 24h of the disclosure. Not sure if every script kiddy can do it, but this means that there are certainly malicious people/organizations who can.
Ultimately, it seems to me that the only real choice is to patch our (public) systems ASAP these days.