Post

The PHP vulnerability today has been handled absolutely awfully. Unreal that the exploit was leaked before a fix was even available

Scan@scanash.com

Can't understand why the PHP maintainers scheduled a security update about a vulnerability that was leaked and then was actively being exploited I'm pretty sure as one of the biggest technologies in the web, you could've you know, released a patch quickly

21/10/26, 5:38 pm1 repost15 likes

ednl🇪🇺

@ee1.nl

That's hardly the PHP org's fault, is it.

ednl🇪🇺

@ee1.nl

mastodon.social/@BjornW/1174...

YetAnotherSteve

@yaseppochi.bsky.social

Dunno. Took a couple months to develop the fix involving a new release, Catalin Cimpanu (Risky Biz News) *didn’t* run it before it was announced by PHP, 24 hours later everyone has packages and a team prepared to handle inevitable upgrade glitches as well as the “apt upgrade php” part. LGTM

YetAnotherSteve

@yaseppochi.bsky.social

I mean in all seriousness there are people out there whose business model is front-running fixes. Of course those miscreants went balls to the wall on these vulnerabilities (AFAIK only one was publicly described before the fix was released).

Emily Hunt

@emily.space

This problem was first identified in *2024* (see below). The problem was re-identified this summer. Then, it got leaked. Then, a security firm released the details of the exploit before the fix soon after the foundation moved the fix forward a day. So many fuck ups 😅

thephp.foundationToday's PHP Security Release, and How We're Strengthening PHP SecurityDescribing the story behind how critical security vulnerabilities were found and fixed.

YetAnotherSteve

@yaseppochi.bsky.social

“No concrete vectors were found” in 2024. If it was a one line patch, you could criticize them for not making it. But it turns out that they had to redesign the whole module. That’s a very risky move. The leak was a selfish act by a single agent, but that’s a necessary risk by the nature of

Man With A Camera

@the-journalist.bsky.social

Infosec is mostly BS because they hyper focus on low priority things.

Andrew Smith

@oldboysmith.bsky.social

Being a old cynic I suspect it might of been the intention to create a panic, so that the involvement of AI was highlighted. Far less impact if the fixes had been made available, installed, and then the discovery process revealed.