Post

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

nightshade →home, for now@nightshade.technology

oh it's bad. oh it's BAD bad. oh this is CATASTROPHIC, drop-whatever-you're-doing-and-patch-NOW levels of bad cert.europa.eu/publications...

Ally Ellee

@allyellee.bsky.social

👋 Hey, ignorant question from a newbie webdev--my domain host has the capability of utilizing PHP, but my personal site is a static one which does not use PHP (as far as I understand). Should I assume my site is still compromised?

nightshade →home, for now

@nightshade.technology

no. your site is not compromised; serving purely static files, or using a web server that does not run PHP code, means your site will not be affected.

21/10/26, 12:16 pm0 reposts19 likes

Ally Ellee

@allyellee.bsky.social

Reall good to know, thank you! Fingers crossed for all those affected that nothing dire happens until patch time.

nightshade →home, for now

@nightshade.technology

the real impact isn't going to be at patch time, it'll be after. so many systems will be unable to install the patches and will fall victim almost immediately.