upvote

points

by bombcar8 hours ago |
comments
upvoteby dannyw8 hours ago|
next
[-]
I imagine more details will come out over the coming days, but it’s not uncommon for severity to be under-estimated in the beginning; and then “oh shit” as you dig deeper.

We don’t know when it went from a “memory safety issue” to “php2shell/RCE”.

Calif’s report is a little light on timelines, but reading between the lines, it seems they took a while to turn this into an actually exploitable vulnerability.

Finally, at least pre-LLM (and maybe a bit outdated now), responsible security disclosure norms is that you usually do wait for vendor (up to 90d) if there’s no signs of active exploitation. Even if it’s a RCE. Actually, especially if it’s a RCE.

The last thing you wanna do is go pinging random non-security PHP contributors or maintainers and have it leak with zero patch. That is truly the worst outcome.

Yes, this is bad, but also, it’s apparently been bad for decades; and it could’ve been much worse.

reply
upvoteby Maxious8 hours ago|
parent|
[-]
According to this post, one of the researchers was a former PHP security lead who already knew about the bug since 2004. So I'd assume they would be taken as credible by the current team https://calif.io/php2shell/
reply
upvoteby dwohnitmok7 hours ago|
parent|
next
[-]
As I mention elsewhere (https://bugs.php.net/bug.php?id=78876) I'm very confused. Looking at the PHP bug tracker the specific bugs were fixed. So my best guess is that the LLM was able to find alternative variants that still worked? But then the report makes less sense.
reply
upvoteby Twirrim8 hours ago|
parent|
prev|
next
[-]
Assuming that it could have been spotted in their inbox, amongst a probable flooded of LLM slop like a number of security mailing lists for open source projects that I know of. We've all seen the impact on open source github issues, hackerone etc. The same is happening to standard email disclosure paths.
reply
upvoteby soulofmischief5 hours ago|
parent|
prev|
[-]
These illustrations are neat but severely distracting given that each make a mountain out of a molehill.
reply
upvoteby john_strinlai8 hours ago|
prev|
next
[-]
>This really sounds to me like "they filled out some webform" or "sent an email to security@php that read like any of the ten billion we found vulnerability in your code please send money emails

i highly doubt it. these are pretty big names in the security sector who have plenty of experience reporting high severity vulns.

reply
upvoteby fock8 hours ago|
parent|
[-]
and they also have plenty of exposure to their motherships burning money on LLMs
reply
upvoteby ferngodfather5 hours ago|
prev|
next
[-]
I've said elsewhere I am sick to death of reading AI written "security disclosures". Even for genuine issues, it just saps my motivation to fix them.

That said, PHP team handled this poorly. How does letting everyone know so they can "prepare" help anyone at all. It just creates panic.

reply
upvoteby letmevoteplease4 hours ago|
parent|
next
[-]
If you provide forewarning, system administrators around the world in various time zones can get ready to update at the same hour the fix is released, which is very important. Being hours late is not acceptable for a vulnerability like this.
reply
upvoteby ferngodfather3 hours ago|
parent|
[-]
And yet it seems all their forewarning did was lead to the proof of concept being leaked many 'valuable' hours before.
reply
upvoteby paulddraper3 hours ago|
prev|
[-]
Are you victim blaming the reporter?

If you have a bad process, fix the process.

reply