Post

Ed
@ed3d.net

if as reported, this might be the worst vuln of my adult life? I'm really glad I'm between jobs right now

nightshade →eth0:2026@nightshade.technology

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

Ed
@ed3d.net

`session.upload_progress.enabled = Off` is a stopgap, so at least it isn't as demonic as like, heartbleed remediation was, but enjoy figuring out whether your router has been weaseled or whatever I want to say that only the PHP team could cause a heap UAF, but someone else will live down to that

jackalsyn.comOnly for the curious...

5 reposts58 likes

the autumn and the scarlet 🍁
@marcy.beneprism.rip

It's so funny to read this stuff in modelese. The latest thing I've gotten hung up on is this pattern: "['Everything is accounted for']: the [possibly irrelevant detail], the [definitely irrelevant detail], the [???]". It loves to put these in PR descriptions (which I don't let it write)