I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796
Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?
Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites
What confuses me as someone who hasn’t written PHP in ages, is why is it supposedly so easy for a request to hit the memory limit? Does this only work on servers that accept user uploads and other large request payloads? People are saying a static PHP page can be exploited, but I don’t understand how if it’s behind even a basic nginx instance with default request limit of 1MB.