This is and update on the php2shell vulnerability and a response to the blog post from https://lemmy.world/post/53441818 : https://eliastaylor.com/noexploit/
This is and update on the php2shell vulnerability and a response to the blog post from https://lemmy.world/post/53441818 : https://eliastaylor.com/noexploit/
I guess nearly everybody has installed the patch by now. Even myself :)
Maybe we are going to see “scanner” websites for such patch situations in the future, with a world map and statistics where are how many unpatched servers…
You mean things that already exist, like https://shodan.io/?
I don’t know. What does it tell about patches on servers (who don’t easily show their internals in such detail)?
Some servers do publically list their PHP version, and as an example there are currently ~23,000 that list PHP 8.5.11: https://www.shodan.io/search?query=PHP%2F8.5.11
Sure these could be a manually patched version of 8.5.11, but I find that pretty unlikely.
Yes, hopefully most people had time to install the updates. And maybe the false exploit reports helped slow down malicious people too.
Don’t people use unattended upgrades? Crowdsec’s WAF AppSec or Cloudfare’s WAF also put out patches that would’ve caught these vulnerabilities before the official PHP patches were released.
Of course, those normally run once per 24 hours, which is a little late…
No. Unattended upgrades are a nightmare in production. If you patch stuff manually or even with ansible, you can see what the hell broke during the upgrade. Whereas with unattended access you walk in Monday morning with half your systems down and no idea which update broke it.