I'm on Gentoo and when I compile my kernel, by default, almost nothing is enabled.
On other distros they throw in the kitchen sink because it is easier than making an endless amount of them customized to every system.
mycall 2 hours ago [-]
Gentoo seems like a nice in between to standard distros and unikernels.
whalesalad 1 hours ago [-]
You can build your own kernel on any distribution fwiw
daymanstep 21 hours ago [-]
The bug doesn't mention MPTCP, is MPTCP required for the bug to be exploitable?
dboreham 18 hours ago [-]
No, but MPTCP makes it more likely to be exploited, supposedly.
anthk 18 hours ago [-]
SMB in the kernel and binding io_uring to DMABUF doesn't look pretty safe either.
Torvalds needs to borrow Rust code from Asterinas (and maybe Redox) ASAP.
pseudohadamard 4 hours ago [-]
Years ago I talked to an ex-msft guy whose comment on Samba was "they're repeating all of the same mistakes we made". It was a tongue-in-cheek comment about how compatible Samba was with Microsoft's SMB implementation.
robwayne 15 hours ago [-]
> Linux seems to have a huge attack surface that doesn't necessarily need to be there for every user/server.
IIRC it was CVE-2026-31431 earlier this year that made me go audit what modules were loaded and go on a whole hardening kick. As far as I understood, the vulnerable module (algif_aead) wasn't even commonly used by anything.
So why is it loaded by default? It's just an extra code path to potentially exploit my system with. It's even marked deprecated (and insecure!), yet a fresh NixOS (and Arch, I believe) install has it loaded out of the box.
I mean, I get it, broad compatibility and all that jazz... but still.
codedokode 12 hours ago [-]
On Android many things available on Desktop Linux are disabled by selinux. For example, af_alg algorithm (encryption kernel module writes out of bounds) is not accessible by user using ADB.
cowlevel 15 hours ago [-]
The XFRM thing is probably Dirty Frag, patched several months ago.
0xbadcafebee 13 hours ago [-]
Everything is enabled by default in Linux, it's just their way. Privilege escalation exploits for Linux are found every year. If you can RCE a Linux box, assume you can also get root.
athrowaway3z 1 days ago [-]
> A1 — Memory Exhaustion (~383MB):
I'm actually somewhat surprised at the clumsiness here.
I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it.
DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - https://github.com/KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests.
Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.
rootsudo 1 days ago [-]
Interesting, my deepseek session did find it.
SV_BubbleTime 12 hours ago [-]
You probably just have added “find all exploits” and “breathe slowly, relax, and focus”…
Sorry, I still resent the moronic 2024 “Prompt Engineering” guides that were obviously bullshit and non-falsifiable random claims.
rootsudo 9 hours ago [-]
no I was doing a back and forth council with chatgpt and it was fun chatgpt wouldn't do it but deepseek did and it pushed each other further it was really cool
cost me $10 in the end to run it fo about 10 hours straight, since I hit it in daytime hours
0x457 19 hours ago [-]
My Qwen3.8-27B was able to do it.
iririririr 22 hours ago [-]
this featured is disabled in any security conscious deployed (which doesn't seem to be the case for some large firewall vendor)
colemannugent 24 hours ago [-]
Reading this I'm almost certain the firewall vendor is Palo Alto Networks. They included a PAN-OS setting verbatim and the SELinux config matches my experience.
nubinetwork 19 hours ago [-]
> Since this discovery, the Dream research team has been sharing updates and collaborating on an investigation with Palo Alto Networks, the vendor of the firewall in question. More information is available on the Palo Alto Networks website. Additional details are now included in the post itself.
theMMaI 23 hours ago [-]
Further indication is that PHP 7.4.33 and PHP 8.30.0 are mentioned which are an exact match for PAN-OS 11.1/11.2 and 12.1/12.2 respectively
elevation 23 hours ago [-]
Why does a world-class firewall stack need PHP? I'm sure PAN-OS has some neat DPI features, but I would love to see firewalls that are implemented in FPGA, where the tasking was compiled down to gates to be performed deterministically, much like the low port count network switches we have today.
tredre3 22 hours ago [-]
What else would you use to power the configuration gui frontend? Allow me to eliminate some of the obvious and inevitable answers:
- Rust didn't exist at the time
- Go didn't exist at the time
- nodejs didn't exist at the time
- Java and Python likely used too much resources for a once-in-a-while used GUI
Irrational hatred aside, that's literally what PHP was designed for.
elevation 20 hours ago [-]
> Irrational hatred aside, that's literally what PHP was designed for.
Yes, in 2005 you choose PHP, but in 20 years of operation, you don't revisit reconsider your architectural considerations? A fantastic avenue for hardening any product would be to replace a ~2MSLOC component (the PHP interpreter) with a 10K SLOC daemon that does only what you need.
When you're a startup, expediency and funding prevent this, but by the time you're selling "solutions" and baking designs into ASICs you could have prevented this attack by putting a fraction of the effort into software.
ferngodfather 18 hours ago [-]
This is great to say with the benefit of hindsight but nobody is changing the underlying language of their well established product for literally no reason.
And that is even with the assumption that other languages don't have issues - they do.
Dylan16807 17 hours ago [-]
> literally no reason
PHP being big and creaky was very well known. This has nothing to do with hindsight.
And it still is big and creaky. You can cite this comment the next time something like this happens to prove it's not hindsight bias.
> And that is even with the assumption that other languages don't have issues
Incorrect. Please do not strawman.
deadbunny 18 hours ago [-]
At which point during that 20 years do you decide to rewrite a ton of your production code just to change languages?
fn-mote 17 hours ago [-]
When you are making a lot of money and have a security analysis of your stack.
raptor99 14 hours ago [-]
I wonder if that's why Palo and PanOS have had so many vulnerabilities this year and last
0xbadcafebee 13 hours ago [-]
I get that logically you would think that a very wealthy company would improve their technology once they had the resources to do that. But companies do not run by logic. They run by humans, making human decisions, motivated by almost every conceivable thing except logic.
> When you're a startup, expediency and funding prevent this, but by the time you're selling "solutions" and baking designs into ASICs you
.... are still run by the same startup people who think "working like a startup" was a good idea in the first place.
Right now I work with a bunch of people who came up working for startups. They are responsible for the products that make the company the most money. They are still on PHP 7.4.
citrin_ru 20 hours ago [-]
Lua? Tcl? both AFAIK have less vulnerabilities than PHP likely thanks to smaller code size.
cesarb 22 hours ago [-]
> What else would you use to power the configuration gui frontend?
Perl?
seanhunter 21 hours ago [-]
For some reason I’m not allowed to respond to the child comment so I’m putting this here:
Perl 5 was released in 1994. Palo Alto Networks was founded in 2005, so Perl 5 was certainly available when they built their first products and would have been a superior choice to either PHP or Perl 4.
ExoticPearTree 17 hours ago [-]
When discussing programming languages, you need to take into consideration how easy it is to find developers with experience on a certain language.
Sure, you can do web apps in Perl with Catalyst or other frameworks, but the PHP developers are easier to find.
And then, after you develop entire GUIs in a language, it is a herculean effort to port that to another.
And lastly, JavaScript has its own issues too.
j16sdiz 13 hours ago [-]
We were talking about early 2000s.
Perl 5 was the language of choice for CGI in that era, but PHP borrowed some of perl syntax and quickly displaced Perl in web usage.
Some perl programmers migrated to Embperl, but it didn't gain much momentum.
Dylan16807 17 hours ago [-]
We're talking about an html GUI right? That's not herculean to port between languages.
redundantly 16 hours ago [-]
The difficult part isn't rendering the UI, it's the work that's done between the UI and the back end components/services that's difficult. PHP is used for more than just web pages.
Dylan16807 13 hours ago [-]
But that glue is pretty straightforward and you only have to convert one page at a time.
ExoticPearTree 6 hours ago [-]
I don’t think you ever went through something like this ever.
It is a huge effort even migrating from one PHP framework to another.
Coming back to your point, there is no single “page” to be migrated one at a time.
Dylan16807 4 hours ago [-]
It's just the configuration pages. It's not the core of the product and doesn't need to be a perfect clone.
Is there a reason one URL at a time wouldn't work?
ExoticPearTree 19 minutes ago [-]
My last comment on this: it is not "one URL" or "just configuration pages", it is an entire application, it does not have distinct "pages" that can be replaced with something written in a different programming language.
You can always take a look at the UI of a PAN device and use your browser in developer mode to see how it works and understand the concept of a web application.
topham 21 hours ago [-]
You win.
Perl 4 specifically of course though.
nocman 20 minutes ago [-]
> Perl 4 specifically of course though.
Not in 2005. Perl 5 all the way, baby!
bigbuppo 21 hours ago [-]
That's for mission-critical load-bearing infrastructure hidden behind modernized interfaces. Nobody has touched that script in 33 years.
19 hours ago [-]
tiberious726 21 hours ago [-]
This makes me kinda furious. The us government makes me do so much goddamned work to comply with their cyber security regulations (only about half of which actually contribute to my security posture), and here they are running their fucking firewall management page publicly exposed (the globalprotect portal was not vulnerable, only the _actual_ management page).
acdha 19 hours ago [-]
Remember that the non-defense sector of the government has been having cuts for decades and lots of important work is outsourced to rotating contract teams. This is definitely unacceptable but I'd bet there were more than a few people there who were profoundly unsurprised that the backlog caught up with them.
WarmWash 21 hours ago [-]
The government tends to have the magical combination of total power combined with low to moderate skill.
goldie_wilson 20 hours ago [-]
The title is misleading as the article says "including systems in a US government-affiliated environment" which reads more like a 3rd party the government is contracted with versus actual government systems.
clbrmbr 23 hours ago [-]
public markets point to FORTINET
xxmarkuski 1 days ago [-]
Dream is btw founded and led by Sebastian Kurz, who was head of the Austrian government. He had to step down because of a corruption scandal.
Topfi 1 days ago [-]
For our US friends, as context, this is akin to Rudy Giuliani being a cybersecurity expert. Partly, because it simply never was Sebastian Kurzs area of expertise, mainly because the referenced corruption scandal centered around the use of Whatsapp to facilitate said corruption, so, you know...
The NY politician to grifter pipeline is interesting (Giuliani, Adams, Cuomo).
nostrademons 18 hours ago [-]
You sure it's not a grifter to NY politician pipeline?
All my NYC relatives seem to have choice (unfavorable) words to say about every single one of their politicians, and have ever since Koch's 3rd term.
It's hard to serve 11M people, so most people who get into that position do so by promising to serve 11M people and then serving themselves.
wildzzz 16 hours ago [-]
New York's favorite thing to do is vote in the worst people and then complain nonstop.
nostrademons 16 hours ago [-]
I sometimes wonder if this is the true function of leaders in a democracy. To serve as a scapegoat so that the electorate has somebody to blame for all the unsolved problems in their life. It's psychologically much easier to believe that you're held down by the government and discharge responsibility for fixing your life to your government leaders than it is to take the long, challenging and often risky steps toward improving your actual life. Also, people who do take the latter path often end up with noticeably better lives over the years, and yet few people take that path.
Note that electing clowns to public office is not unique to NYC - we've had a reality TV star and an actor as POTUS (the latter also serving as governor of California), Toronto has elected a criminal as mayor, Minnesota got a pro-wrestler as governor, South Korea had multiple presidents resign in disgrace, and South America seems to have politicians ping-pong between prison and presidency.
chneu 10 hours ago [-]
I think you're maybe kind of right. We convince ourselves that politicians are idiots so we elect idiots.
I think the biggest change is we don't really hold them accountable anymore, at least in western democracies. Maybe we never really did.
milleramp 13 hours ago [-]
And non-partisan!
rotis 23 hours ago [-]
He has already IT experience then. Surely he learned something out of it. Securely using apps. Discretely handling deals, etc.
Anyway from their webpage:
> We work directly with heads of state, ministries, national cyber authorities, and the senior officials responsible for executing national strategy.
So I presume he has and provides contacts. Just the usual one hand washes the other. Nothing nefarious I'm sure.
ungut 22 hours ago [-]
LMAO, you mean he learned to install Signal and turn on disappearing messages after all of his chat messages, obviously implying corrupt political practices, were read in a special government committee?
The guy doesn't even know what DHCP is, "I'm sure".
I almost feel bad that company is getting traffic from HN. Kurz is such a disgusting little worm.
cookiengineer 1 days ago [-]
One of the three co-founders also founded NSO Group, and was developing the Pegasus malware.
Just for context, that is the type of evil we're talking about here.
Extremely wrong. I'm not sure how "RCE on every PHP server, from anywhere on the internet, no other requirements" could possibly be underblown by anyone. Exploiting the PHP request parser bypasses basically all security checks and it doesn't matter how secure your code is because the exploitable component runs before your code and can't be disabled.
I am very curious to hear why you thought it was overblown.
There was also that other guy who posted "steal my bitcoin" on a vulnerable PHP server with the private keys to prove it was overblown, and got his bitcoin stolen within a day.
jerf 1 days ago [-]
"There was also that other guy who posted "steal my bitcoin" on a vulnerable PHP server with the private keys to prove it was overblown, and got his bitcoin stolen within a day."
Part of the confusion is that the initial PR for the release made it sound like there was a ready-to-go exploit that was just push button, get shell on any PHP server in the world. That turned out not to be the case, as evidenced by the fact that the number was 19 hours and not 19 minutes.
But the fact that it was 19 hours and not "never" also does provide a data point that everything that was vulnerable really was vulnerable, it just may not have been quite as vulnerable as it was initially presented. Still plenty vulnerable, of course.
My point here being that the initial 24 hours were very confusing and I think it's worth remembering that and giving people grace for it. Even now, I've heard rumors of an exploit that does work on all boxes without making changes for a specific target but I'm not actually sure whether that exists or not. (Any further info welcome.)
NitpickLawyer 1 days ago [-]
It's not 19hours. The server was originally configured with no running php. Once they added a php file, the server got pwned in 2 hours.
jerf 23 hours ago [-]
Interesting. I did not know that. (Obviously.)
0x457 19 hours ago [-]
This exploit depends on the deployment. With PHP-FPM, an OOM during request startup terminates the child, so the corrupted state wouldn’t survive for subsequent requests to exploit. The challenge used PHP’s built-in server, where the worker was reused.
Doesn't mean that there isn't another exploit chain that can be used though. Challenge also had 4 workers total, so pining one worker wasn't that hard.
kylestanfield 23 hours ago [-]
In online communities right now there’s a lot of demand for evidence of LLM capabilities being overblown. It’s unfortunate that even if the steal my bitcoin creator apologizes for spreading misinformation due to incompetence, the truth won’t be spread as widely.
cowlevel 1 days ago [-]
Shutting down half the internet was the right move. If it took someone 19 hours to exploit a site, you'd better have shut it down before 19 hours and not after.
I don't see what was confusing about the initial 24 hours. GP was correct, the description of the bug made it clear it was a very high risk.
beepbooptheory 1 days ago [-]
Also, unless I am reading this wrong, it does not seem like what actually got the bitcoin was a 2shell-like exploit? Seems like memory corruption leading to printing out the flag through just http requests? How would you use this outside of a CTF context?
2shell is catchy shorthand for "do anything". log4shell (originator of the name?) didn't directly give you a shell either, it ran some Java code. You could have a shell if you wanted to.
jrflo 1 days ago [-]
I think it goes back to the huge amount of anti-AI sentiment that's out there today. Any AI accomplishment gets undersold by haters, i.e. people maintaining that the Navier-Stokes solution was stolen, people saying that Lean proofs can't be relied on, exploits like PHP2Shell are esoteric and not usable in the real-world, etc. Those are just comments I recall reading off the top of my head but I could find sources if anyone wants. I think it's just a way for people to cope and fool themselves into thinking that this whole AI thing isn't a big deal and will just blow over.
jstanley 1 days ago [-]
> I'm not sure how "RCE on every PHP server, from anywhere on the internet, no other requirements" could possibly be underblown by anyone
It could be overblown if it's not true. The amount of time it took for anyone to claim the Bitcoin from the supposedly-vulnerable PHP site convinced a lot of people that the vulnerability was not as bad as claimed.
jooops1 19 hours ago [-]
Why would someone send their exploit chain to a random for a mediocre 'bug bounty'. The bounty was later claimed by people who just did It for fun after work for fun with a LLM of their choice quickly.
tkz1312 1 days ago [-]
wasn't it setup in an unexploitable configuration (not actually serving a php page IIRC?) for most of the time, and then got popped within like 2 hours once fixed?
lifeisloving 1 days ago [-]
The point is, under normal configurations when you're serving the PHP server correctly with table-stakes best practices the server is not exploitable
This was not a scary vuln at all.
literalAardvark 23 hours ago [-]
Under normal configurations the server is highly exploitable.
It's a horrible vuln and I don't understand what's with all the flat infosec society coming out of the woodwork.
The challenge server had vibe coded infra that made it hard or impossible to hack, but it was a configuration that can't be used in production and no one uses ( it was deployed as a PHP static content server instead of a dynamic site generator )
pixl97 21 hours ago [-]
>I don't understand what's with all the flat infosec society coming out of the woodwork.
Ha, while most of these are probably humans that are just being driven mad by AI, I wonder how long before we get AI driven botnets that try to under play any security vulns to give them more time to take over and collect assets for themselves?
9dev 18 hours ago [-]
Are you sure this isn’t already happening?
Urd- 1 days ago [-]
Normal configuration of a PHP server is to not run any PHP code and serve a static html file?
lifeisloving 23 hours ago [-]
Where is all the evidence of exploits if most of the webs PHP servers were vulnerable?
This is a seperate chained exploit itself, seemingly executed by a nation stae. There are thousands of exploits infiltrating web servers around the world daily, and they arent php2shell.
You only care about this because it falls into a weird viral narrative about "AI saftey".
literalAardvark 23 hours ago [-]
There's nothing separate about this.
Chained just means they used php2shell to run a local privilege escalation.
lifeisloving 22 hours ago [-]
Was the exploit not dependent on a kernel exploit that was disclosed and patched in may, or am I just hallucinating?
literalAardvark 21 hours ago [-]
Depends which part: php2shell does what it says on the tin: lets you run arbitrary commands as www-data.
If you want more than that you need to chain an LPE. Which are plenty these days sadly.
cowlevel 1 days ago [-]
Which best practices did you use to prevent exploitability?
And would you stake your bitcoin on it?
devin 23 hours ago [-]
I had a similar take, but I was wrong.
lifeisloving 22 hours ago [-]
How were you wrong? Out of 15k targets scanned they arrived at 25 servers total.
1718627440 1 days ago [-]
> I am very curious to hear why you thought it was overblown.
Not having made the claim (took down my website too), but because PHP is not connected directly to the network. While you cannot prevent PHP from being overtaken from inside the PHP program, you can prevent PHP being executed on malicious data by configuring the webserver. It's overblown in the sense that it would be even more serious if the same happened in the webserver itself.
cowlevel 1 days ago [-]
Can you? Initial suggestions to block multipart content-types were a red herring.
1718627440 1 days ago [-]
In theory yes. In practice, I don't know, I hope my provider patched it properly.
cowlevel 24 hours ago [-]
What specific configuration would you recommend to block the vulnerability without actually patching it?
kalleboo 14 hours ago [-]
You could configure your web server to only allow one request per worker, which means the corrupted memory can not get used by the attacker. Not great for performance, obviously.
1718627440 24 hours ago [-]
None. Like I wrote "I don't know, I hope my provider patched it properly."
cowlevel 23 hours ago [-]
Then why did you say
> you can prevent PHP being executed on malicious data by configuring the webserver.
jstanley 23 hours ago [-]
Configure your webserver to not execute PHP code.
1718627440 23 hours ago [-]
You can do this. I don't know how, and I don't think it's a feasible use of my time, to find out how. It's obviously computable on a Turing machine, because they were able to patch PHP.
cowlevel 22 hours ago [-]
So it was useless advice? You presented it as if anyone not following the advice is incompetent, now you suggest nobody knows how to do it. Is everyone incompetent?
1718627440 22 hours ago [-]
What? I never claimed it was "advice"? I explained how other people could have arrived at the conclusion that there can be worse things than a single language interpreter being vulnerable to a unconditional RCE. Were you answering to the wrong comment?
kxrm 22 hours ago [-]
> I don't know how
You are spreading misinformation then.
The configuration change was never a full protection from this vulnerability because the problem is with how PHP processed the request well before the configuration or your PHP code was executed.
1718627440 21 hours ago [-]
> You are spreading misinformation then.
?
> because the problem is with how PHP processed the request well before the configuration or your PHP code was executed.
That's what I wrote? You can't do anything once PHP executed. It could still be worse, because you can still prevent PHP from running, because there is still the webserver before. If it were in the webserver itself, you couldn't do anything, short of stopping the server from running.
> The configuration change was never a full protection from this vulnerability
It is, if the configuration change prevents PHP from running. That's how you could say it is overblown. You are not vulnerable if you don't run PHP.
cowlevel 15 hours ago [-]
So basically what you're saying is you aren't vulnerable if you turn off your website.
The server configuration to mitigate this is to comment out the whole configuration so there's no server.
Dylan16807 17 hours ago [-]
You kept talking about some configuration change that makes things "overblown", without making it clear you meant "turn off PHP". So yes that's misinformation.
It's not overblown if the only non-patch fix is "turn off PHP".
And that's assuming you actually meant "turn off PHP" the entire time? Your earlier phrasing suggests you have something that leaves PHP running in mind, but if that's entirely hypothetical then again we're back to misinformation. (And when you argue it's Turing complete, that only means that a patch must be possible. It doesn't mean there's a config fix.)
Edit: stray "not"
1718627440 16 hours ago [-]
My first statement was "Not having made the claim", to indicate that I do not necessarily think that. My second was "took down my website too" to indicate, based on what understanding I did and plan to act on.
> And when you argue it's Turing complete, that only means that a patch must be possible. It doesn't mean there's a config fix
The config could be, run a simulation on the input data to decide whether it would allow for RCE and then decide whether to run PHP or not. I sure hope nobody is actually doing that, but it is sure possible.
> And that's assuming you actually meant "turn off PHP" the entire time?
I did mean "only execute PHP, when you know the input doesn't trigger it", the policy of never invoking PHP at all, does satisfy that.
Dylan16807 16 hours ago [-]
> The config could be, run a simulation on the input data to decide whether it would allow for RCE and then decide whether to run PHP or not. I sure hope nobody is actually doing that, but it is sure possible.
That is not a config. That's a whole new program.
> My first statement was "Not having made the claim", to indicate that I do not necessarily think that. My second was "took down my website too" to indicate, based on what understanding I did and plan to act on.
But with everything else you still made it sound like you were supporting it.
> I did mean "only execute PHP, when you know the input doesn't trigger it", the policy of never invoking PHP at all, does satisfy that.
It satisfies it, but in a way that doesn't make the exploit overblown.
It's obvious that you can avoid a PHP exploit by turning off PHP. That's not nearly enough to make the worries overblown.
"It could be even worse" is the only conclusion we can draw from it being in php and not the web server. And that conclusion is basically meaningless.
1718627440 16 hours ago [-]
> And that conclusion is basically meaningless.
That's the distinction between being able to do something or not if you do not have control over the webserver, as is likely the case for a lot or PHP websites, so I wouldn't say it's meaningless.
17 hours ago [-]
swat535 20 hours ago [-]
Reminds me a recent article that went viral on HN,
claiming: "There isn't an easy exploit for this PHP vulnerability"..
Its overblown in the sense that 70% of the internet was not in fact vulnerable, as widely reported. And not everyone is a hackor because they have access to llms. Go look at normie coverage from people like Linus tech tips and you'll see them saying how millions of servers were under attack by script kiddies with llms, amd how llms are so dangerous.
The whole thing was basically a psyop, whether intential or not idk but Califs research was funded in part by OpenAI so there's that.
robby_w_g 1 days ago [-]
I agree. There's nuance to it. I believe the CVE was overblown, and I also believe that it is a severe vulnerability that should be addressed ASAP. 2 things can be true at once.
It was OpenAI's marketing that hyped up the vulnerability to the point that guys on my hockey team saw it in the news and were asking about it. There doesn't need to be mainstream articles about it, these kinds of vulnerabilities happen every year. Just patch and move on.
literalAardvark 23 hours ago [-]
The CVE was not overblown. It's correctly marked as a 9.2.
Random bloggers jumped on it and said dumb blogger things. That is all.
This is one of the worst vulns ever and the security response from the people who actually secure things for a living was entirely warranted regardless of whether some blogger thought it was the AI apocalypse or not.
cowlevel 1 days ago [-]
This was a vulnerability worse than Heartbleed. Did they hear about Heartbleed?
Topfi 1 days ago [-]
Respect, hats off to reevaluate when presented with the info. Will fully admit, I myself lacked the ability to assess the true severity, mainly cause I try to stay away from PHP since my first encounter in sixth grade, so was going a bit back-and-forth due to what I was reading.
Mainly saw the severity in the economic impact of having to quickly patch so much, but taking offline being the right choice given the risk, along with of course all the decades old, never patches, blogs being botnet targets someday in the future, akin to Wordpress being commonly used for Ransomware hosting for similar reasons. And of course hopefully learning something from the timeline and leak for future disclosures. Feel things need to generally change from the status quo, barely has changed since the 2015 Google/MSFT squabble...
rkozik1989 1 days ago [-]
Yes, you were. These exploits are happening in processes like php-fpm before it actually executes any code for the web application, so its not like you need to find endpoint where a specific class is being invoked or anything like that.
genxy 16 hours ago [-]
Perhaps you violated Clarke's First Law
> When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong.
I find statements like yours to not be about objective truth, but rather a narcissistic view of world where if it was hard for you, it must not be possible. It is more of a comparison of yourself vs the world.
I commend you to having corrected your thoughts this publicly fwiw.
We need more of this.
mrdootdoot 13 hours ago [-]
Hi all. Reading these every day now. Is public cloud safe anymore or the internet in general? Or are we just choosing to live in a reality where their mondo security budgets head off these exploits - and yeah, naw - coming clean is still more expensive than burying incidents?
Edit: “Or the internet in general” - and yes internet was never safe but this is just next level. You seem to do everything right and it doesn’t matter. Is o365 really safe for example? I’m rapidly seeing my faith in SaaS platforms degrade - they can’t be immune to all
Of this
codegeek 1 days ago [-]
I am confused. Is this attack possible even after the PHP patches OR these servers just didn't patch ?
jdiff 1 days ago [-]
> The affected devices run specific versions of a large vendor’s firewall software.
And the vendor's firewall software runs an unpatched version.
sznio 1 days ago [-]
I bet it's fortinet.
theMMaI 24 hours ago [-]
Or Palo Alto networks
colemannugent 24 hours ago [-]
This is 100% PAN-OS
mentalgear 20 hours ago [-]
Maybe we going to have to shut down the Internet soon. Maybe it won’t be such a bad thing to become more local and decentralized again.
fierycatnet 19 hours ago [-]
That's wild, I remember in early 2000s it was super easy to upload a PHP file with a shell. Back when hostings were shared, one shell could get you access to the whole host.
zeilenende 17 hours ago [-]
[flagged]
loeg 22 hours ago [-]
> For security purposes, we are not disclosing the vendor or the affected versions
Wat
jtchang 16 hours ago [-]
Why are there any management interfaces exposed to the Internet at all?
steve_adams_86 13 hours ago [-]
I don't know, strange things happen. The other day I had to rotate a bunch of credentials because a coop cloned a private repo, made it public, and checked in a .env file with production database credentials... 5 years ago. And they still worked. No idea how that wasn't exploited, honestly.
(I wasn't around for this, I just found it)
bix6 1 days ago [-]
It sounds like multiple things were misconfigured on these servers and they still have access?!?
npn 23 hours ago [-]
> Claude Code had been installed
I just do not understand. CC is not the sole harness in the world, why the attackers insist to use it.
j45 22 hours ago [-]
Wild, I hope the challenge on HN didn't contribute to this.
jvandijk 1 days ago [-]
Haha woopsie
brcmthrowaway 22 hours ago [-]
With software being fundamentally unsafe I see everything hardwired in chips.
FPGA stocks? DV is about to become hot again..
unethical_ban 20 hours ago [-]
So logical flaws can't be patched without hardware replacement? Software isn't fundamentally unsafe. We're in a gap era where the capability to discover bugs is greater than the response time and pre-emptive hardening of software written without AI assistance. This gap will eventually get smaller.
tamimio 1 days ago [-]
Firewalls are likely fortinet
kekub 24 hours ago [-]
Nah, I guess it is Palo Alto. PHP and Appweb is their stack AFAIK. Forti does not use PHP, Juniper uses Appweb with PHP but on FreeBSD - but the article mentions SELinux.
paxy 1 days ago [-]
Now let’s watch the goalposts shift in real time about how severe this vulnerability is.
ofjcihen 1 days ago [-]
Most goalposts I’ve seen say “bad but clumsy”.
Believe it or not in cybersecurity there are many considerations in how “bad” a vulnerability is.
tptacek 21 hours ago [-]
Practioners are pretty well settled on how big a deal platform-wide RCE is.
ofjcihen 20 hours ago [-]
They are, and again, believe it or not, more goes into it than “RCE bad”.
Ease of exploitation, feasibility do play a part which I’m sure surprises you.
tptacek 18 hours ago [-]
Not in the sense that people downplaying this vulnerability meant.
ofjcihen 18 hours ago [-]
What does that even mean?
tptacek 18 hours ago [-]
I'd be happy to answer that question if you posed it straight, rather than as a an attempted dunk. Of course, the search bar on this thread will lead you to plenty of additional conversation about the vulnerability and the attempts to downplay it.
ofjcihen 18 hours ago [-]
[flagged]
Dylan16807 17 hours ago [-]
> Believe it or not
> which I’m sure surprises you
You caused the problem here. You started off being hazy and rude.
"Say that again without trying to dunk on anyone if you want me to put effort into responding." seems like a pretty reasonable trade.
ofjcihen 17 hours ago [-]
[flagged]
Dylan16807 17 hours ago [-]
My ability to recognize snark is not carrying water for anyone. It started with your very first comment.
ofjcihen 17 hours ago [-]
Your ability to recognize snark is suspiciously selective too.
Weird.
Dylan16807 17 hours ago [-]
You seem to be reading too hard into what I said. I wasn't giving you an exhaustive list of where the snark lies. I was saying where it started.
Edit: From your reply of "Great work? Do you want a cert to prove how well you perform the function of forum peanut gallery?" it looks like you have abandoned the claim I was being suspiciously selective. Good! We're settled then. I'm going to ignore your weird new goalpost where you get annoyed that someone clarified themselves.
ofjcihen 17 hours ago [-]
[flagged]
sudo_intellect 16 hours ago [-]
Since you're intent on being obtuse, here's an example of a thread of HN downplaying the severity of this last week.
You actually participated in it and called cyber security researchers addicted to likes. Ironic.
ghjkghjkghj 16 hours ago [-]
how does this have anything to do with the original post?
also, psuedo cybersecurity researchers are definitely addicted to likes.
edited: looks like half of that post even agrees with them so i mean...?
pixl97 22 hours ago [-]
With all that said, how exploit chaining is working these days I think most peoples considerations are not weighted toward bad enough.
lunargamma676 1 days ago [-]
Same here, though what stuck with me is that a firewall's admin PHP page was reachable from the internet at all, keep that on a mgmt VLAN.
cowlevel 1 days ago [-]
it probably starts with a correct and safe authorization check, but this vulnerability happens before any user code runs, so every PHP page is vulnerable.
bell-cot 1 days ago [-]
True-ish? If your firewall's admin page is internet-accessible, you have no excuse for not doing "bolted to bedrock" lockdowns of your web server config and your PHP config. Either of which could have blocked exploitation of the PHP vuln.
cowlevel 1 days ago [-]
What's the right level of lockdown? Starting a page with "if not authorized, return 403" would've seemed adequate before this.
Then similar for your web server (Apache, nginx, whatever).
EDIT: About your "would've seemed adequate before this" - I dug up a copy of a PHP v5.2 php.ini file (2-ish decades ago). That file begins thus:
;;;;;;;;;;;
; WARNING ;
;;;;;;;;;;;
; This is the default settings file for new PHP installations.
; By default, PHP installs itself with a configuration suitable for
; development purposes, and *NOT* for production purposes.
; For several security-oriented considerations that should be taken
; before going online with your site, please consult php.ini-recommended
; and http://php.net/manual/en/security.php.
cowlevel 22 hours ago [-]
Zero of these recommendations have anything to do with the present vulnerability.
Linux seems to have a huge attack surface that doesn't necessarily need to be there for every user/server.
E.g. this came out today: CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation [1].
I just disabled mptcp on my systems since I don't use it. Why was it enabled by default?
Can I disable this XFRM thing too?
[1] https://www.penligent.ai/hackinglabs/cve-2026-98432/
On other distros they throw in the kitchen sink because it is easier than making an endless amount of them customized to every system.
Torvalds needs to borrow Rust code from Asterinas (and maybe Redox) ASAP.
IIRC it was CVE-2026-31431 earlier this year that made me go audit what modules were loaded and go on a whole hardening kick. As far as I understood, the vulnerable module (algif_aead) wasn't even commonly used by anything.
So why is it loaded by default? It's just an extra code path to potentially exploit my system with. It's even marked deprecated (and insecure!), yet a fresh NixOS (and Arch, I believe) install has it loaded out of the box.
I mean, I get it, broad compatibility and all that jazz... but still.
I'm actually somewhat surprised at the clumsiness here.
I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it.
DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - https://github.com/KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests.
Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.
Sorry, I still resent the moronic 2024 “Prompt Engineering” guides that were obviously bullshit and non-falsifiable random claims.
cost me $10 in the end to run it fo about 10 hours straight, since I hit it in daytime hours
- Rust didn't exist at the time
- Go didn't exist at the time
- nodejs didn't exist at the time
- Java and Python likely used too much resources for a once-in-a-while used GUI
Irrational hatred aside, that's literally what PHP was designed for.
Yes, in 2005 you choose PHP, but in 20 years of operation, you don't revisit reconsider your architectural considerations? A fantastic avenue for hardening any product would be to replace a ~2MSLOC component (the PHP interpreter) with a 10K SLOC daemon that does only what you need.
When you're a startup, expediency and funding prevent this, but by the time you're selling "solutions" and baking designs into ASICs you could have prevented this attack by putting a fraction of the effort into software.
And that is even with the assumption that other languages don't have issues - they do.
PHP being big and creaky was very well known. This has nothing to do with hindsight.
And it still is big and creaky. You can cite this comment the next time something like this happens to prove it's not hindsight bias.
> And that is even with the assumption that other languages don't have issues
Incorrect. Please do not strawman.
> When you're a startup, expediency and funding prevent this, but by the time you're selling "solutions" and baking designs into ASICs you
.... are still run by the same startup people who think "working like a startup" was a good idea in the first place.
Right now I work with a bunch of people who came up working for startups. They are responsible for the products that make the company the most money. They are still on PHP 7.4.
Perl?
Perl 5 was released in 1994. Palo Alto Networks was founded in 2005, so Perl 5 was certainly available when they built their first products and would have been a superior choice to either PHP or Perl 4.
Sure, you can do web apps in Perl with Catalyst or other frameworks, but the PHP developers are easier to find.
And then, after you develop entire GUIs in a language, it is a herculean effort to port that to another.
And lastly, JavaScript has its own issues too.
Perl 5 was the language of choice for CGI in that era, but PHP borrowed some of perl syntax and quickly displaced Perl in web usage.
Some perl programmers migrated to Embperl, but it didn't gain much momentum.
It is a huge effort even migrating from one PHP framework to another.
Coming back to your point, there is no single “page” to be migrated one at a time.
Is there a reason one URL at a time wouldn't work?
You can always take a look at the UI of a PAN device and use your browser in developer mode to see how it works and understand the concept of a web application.
Perl 4 specifically of course though.
Not in 2005. Perl 5 all the way, baby!
All my NYC relatives seem to have choice (unfavorable) words to say about every single one of their politicians, and have ever since Koch's 3rd term.
It's hard to serve 11M people, so most people who get into that position do so by promising to serve 11M people and then serving themselves.
Note that electing clowns to public office is not unique to NYC - we've had a reality TV star and an actor as POTUS (the latter also serving as governor of California), Toronto has elected a criminal as mayor, Minnesota got a pro-wrestler as governor, South Korea had multiple presidents resign in disgrace, and South America seems to have politicians ping-pong between prison and presidency.
I think the biggest change is we don't really hold them accountable anymore, at least in western democracies. Maybe we never really did.
Anyway from their webpage: > We work directly with heads of state, ministries, national cyber authorities, and the senior officials responsible for executing national strategy.
So I presume he has and provides contacts. Just the usual one hand washes the other. Nothing nefarious I'm sure.
Just for context, that is the type of evil we're talking about here.
A German comedian made an episode about it [1]
[1] https://youtube.com/watch?v=_PF23EdGNcE
If you are still running an old PHP version you are grossly incompetent and should take your server offline.
https://news.ycombinator.com/item?id=50272530
I am very curious to hear why you thought it was overblown.
There was also that other guy who posted "steal my bitcoin" on a vulnerable PHP server with the private keys to prove it was overblown, and got his bitcoin stolen within a day.
19 hours: https://stealmybitcoin.com/
Part of the confusion is that the initial PR for the release made it sound like there was a ready-to-go exploit that was just push button, get shell on any PHP server in the world. That turned out not to be the case, as evidenced by the fact that the number was 19 hours and not 19 minutes.
But the fact that it was 19 hours and not "never" also does provide a data point that everything that was vulnerable really was vulnerable, it just may not have been quite as vulnerable as it was initially presented. Still plenty vulnerable, of course.
My point here being that the initial 24 hours were very confusing and I think it's worth remembering that and giving people grace for it. Even now, I've heard rumors of an exploit that does work on all boxes without making changes for a specific target but I'm not actually sure whether that exists or not. (Any further info welcome.)
Doesn't mean that there isn't another exploit chain that can be used though. Challenge also had 4 workers total, so pining one worker wasn't that hard.
I don't see what was confusing about the initial 24 hours. GP was correct, the description of the bug made it clear it was a very high risk.
https://github.com/KillaBoi/StealMyBitcoin-PoC
It could be overblown if it's not true. The amount of time it took for anyone to claim the Bitcoin from the supposedly-vulnerable PHP site convinced a lot of people that the vulnerability was not as bad as claimed.
This was not a scary vuln at all.
It's a horrible vuln and I don't understand what's with all the flat infosec society coming out of the woodwork.
The challenge server had vibe coded infra that made it hard or impossible to hack, but it was a configuration that can't be used in production and no one uses ( it was deployed as a PHP static content server instead of a dynamic site generator )
Ha, while most of these are probably humans that are just being driven mad by AI, I wonder how long before we get AI driven botnets that try to under play any security vulns to give them more time to take over and collect assets for themselves?
This is a seperate chained exploit itself, seemingly executed by a nation stae. There are thousands of exploits infiltrating web servers around the world daily, and they arent php2shell.
You only care about this because it falls into a weird viral narrative about "AI saftey".
Chained just means they used php2shell to run a local privilege escalation.
If you want more than that you need to chain an LPE. Which are plenty these days sadly.
And would you stake your bitcoin on it?
Not having made the claim (took down my website too), but because PHP is not connected directly to the network. While you cannot prevent PHP from being overtaken from inside the PHP program, you can prevent PHP being executed on malicious data by configuring the webserver. It's overblown in the sense that it would be even more serious if the same happened in the webserver itself.
> you can prevent PHP being executed on malicious data by configuring the webserver.
You are spreading misinformation then.
The configuration change was never a full protection from this vulnerability because the problem is with how PHP processed the request well before the configuration or your PHP code was executed.
?
> because the problem is with how PHP processed the request well before the configuration or your PHP code was executed.
That's what I wrote? You can't do anything once PHP executed. It could still be worse, because you can still prevent PHP from running, because there is still the webserver before. If it were in the webserver itself, you couldn't do anything, short of stopping the server from running.
> The configuration change was never a full protection from this vulnerability
It is, if the configuration change prevents PHP from running. That's how you could say it is overblown. You are not vulnerable if you don't run PHP.
The server configuration to mitigate this is to comment out the whole configuration so there's no server.
It's not overblown if the only non-patch fix is "turn off PHP".
And that's assuming you actually meant "turn off PHP" the entire time? Your earlier phrasing suggests you have something that leaves PHP running in mind, but if that's entirely hypothetical then again we're back to misinformation. (And when you argue it's Turing complete, that only means that a patch must be possible. It doesn't mean there's a config fix.)
Edit: stray "not"
> And when you argue it's Turing complete, that only means that a patch must be possible. It doesn't mean there's a config fix
The config could be, run a simulation on the input data to decide whether it would allow for RCE and then decide whether to run PHP or not. I sure hope nobody is actually doing that, but it is sure possible.
> And that's assuming you actually meant "turn off PHP" the entire time?
I did mean "only execute PHP, when you know the input doesn't trigger it", the policy of never invoking PHP at all, does satisfy that.
That is not a config. That's a whole new program.
> My first statement was "Not having made the claim", to indicate that I do not necessarily think that. My second was "took down my website too" to indicate, based on what understanding I did and plan to act on.
But with everything else you still made it sound like you were supporting it.
> I did mean "only execute PHP, when you know the input doesn't trigger it", the policy of never invoking PHP at all, does satisfy that.
It satisfies it, but in a way that doesn't make the exploit overblown.
It's obvious that you can avoid a PHP exploit by turning off PHP. That's not nearly enough to make the worries overblown.
"It could be even worse" is the only conclusion we can draw from it being in php and not the web server. And that conclusion is basically meaningless.
That's the distinction between being able to do something or not if you do not have control over the webserver, as is likely the case for a lot or PHP websites, so I wouldn't say it's meaningless.
https://news.ycombinator.com/item?id=50188948
The whole thing was basically a psyop, whether intential or not idk but Califs research was funded in part by OpenAI so there's that.
It was OpenAI's marketing that hyped up the vulnerability to the point that guys on my hockey team saw it in the news and were asking about it. There doesn't need to be mainstream articles about it, these kinds of vulnerabilities happen every year. Just patch and move on.
Random bloggers jumped on it and said dumb blogger things. That is all.
This is one of the worst vulns ever and the security response from the people who actually secure things for a living was entirely warranted regardless of whether some blogger thought it was the AI apocalypse or not.
Mainly saw the severity in the economic impact of having to quickly patch so much, but taking offline being the right choice given the risk, along with of course all the decades old, never patches, blogs being botnet targets someday in the future, akin to Wordpress being commonly used for Ransomware hosting for similar reasons. And of course hopefully learning something from the timeline and leak for future disclosures. Feel things need to generally change from the status quo, barely has changed since the 2015 Google/MSFT squabble...
> When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong.
I find statements like yours to not be about objective truth, but rather a narcissistic view of world where if it was hard for you, it must not be possible. It is more of a comparison of yourself vs the world.
See also https://news.ycombinator.com/item?id=50224916 https://news.ycombinator.com/item?id=50225703
We need more of this.
Edit: “Or the internet in general” - and yes internet was never safe but this is just next level. You seem to do everything right and it doesn’t matter. Is o365 really safe for example? I’m rapidly seeing my faith in SaaS platforms degrade - they can’t be immune to all Of this
And the vendor's firewall software runs an unpatched version.
Wat
(I wasn't around for this, I just found it)
I just do not understand. CC is not the sole harness in the world, why the attackers insist to use it.
FPGA stocks? DV is about to become hot again..
Believe it or not in cybersecurity there are many considerations in how “bad” a vulnerability is.
Ease of exploitation, feasibility do play a part which I’m sure surprises you.
> which I’m sure surprises you
You caused the problem here. You started off being hazy and rude.
"Say that again without trying to dunk on anyone if you want me to put effort into responding." seems like a pretty reasonable trade.
Weird.
Edit: From your reply of "Great work? Do you want a cert to prove how well you perform the function of forum peanut gallery?" it looks like you have abandoned the claim I was being suspiciously selective. Good! We're settled then. I'm going to ignore your weird new goalpost where you get annoyed that someone clarified themselves.
https://news.ycombinator.com/item?id=50189820
You actually participated in it and called cyber security researchers addicted to likes. Ironic.
also, psuedo cybersecurity researchers are definitely addicted to likes.
edited: looks like half of that post even agrees with them so i mean...?
Maybe compare with https://github.com/php/php-src/blob/master/php.ini-developme..., too.
Then similar for your web server (Apache, nginx, whatever).
EDIT: About your "would've seemed adequate before this" - I dug up a copy of a PHP v5.2 php.ini file (2-ish decades ago). That file begins thus: