PHP vulnerability

[cattleherd]

IDK where to post this, but there is an insane PHP vulnerability that could expose this sites data or even worse.

Any idea if the Admin is aware of this??

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP patches two critical RCE flaws affecting web servers as Cloudflare reports early exploit attempts, with no confirmed breaches.

thehackernews.com

 

[kratz]

This issue shut down off campus access to my university for the day.
One news report estimate up to 70% of the internet is vulnerable to this issue.

 

[cattleherd]

wild!

This issue shut down off campus access to my university for the day.
One news report estimate up to 70% of the internet is vulnerable to this issue.

wild!

 

[Bruce Monkhouse]

I'm sure Mr. Bobbitt is aware, it's what he does.

This website is just his expensive and time consuming contribution to the military community.

 

[Haggis]

I just received a notice about this from IPSC Ontario regarding their forum. The notice says membership information and registration were not affected.

 

[Mike Bobbitt]

Whoops, totally missed this one and only accidentally found it when I was testing to see if I broke search.

Bruce is right, this is kinda my wheelhouse. We were patched the moment the news broke, along with every IOT device and router in my home network.

Hold on to your hats, AI is going to expose these weaknesses for another year or two before things settle down.

 

[brihard]

Whoops, totally missed this one and only accidentally found it when I was testing to see if I broke search.

Bruce is right, this is kinda my wheelhouse. We were patched the moment the news broke, along with every IOT device and router in my home network.

Hold on to your hats, AI is going to expose these weaknesses for another year or two before things settle down.

Mm hm. Everything new going out the door should get torture tested first, but legacy systems will get ripped to shreds until everything is found and patched.

 

[Mike Bobbitt]

Yep, and there's a lot of stuff out there that is is discontinued, unsupported, forgotten, etc.

I foresee a lot of expensive stuff chucked as e-waste and replaced with new "battle tested" gear. But before that happens there's going to be a lot of small organizations wiped off the map because they forgot about that one old router/NAS/IOT device that allowed the hordes to pour in and cause permanent damage.

My advice: If it connects to your network and you have not upgraded/patched it in the last 30 days, do so now. If there are no available updates, it's likely unsupported. Bin it and find a replacement before it becomes your downfall. [Rinse/repeat this advice every 30 days for the next 2 years.]

Fun times!

 

[dapaterson]

2347

(IYKYK)