PHP2Shell: critical RCE in PHP found by an AI agent, patch releases out now

Chinedu Adeyemi · 12 likes

the fact an agent found it is the real story. we're about to get a flood of these for every old C codebase

Tola Ibrahim · 7 likes

good. id rather the flood come from people disclosing than from people selling

Tanvir Rahman · 3 likes

maintainers are going to burn out tho, thats the cost nobody budgets for

Maya Putri · 9 likes

our hosting provider already auto patched, first time ever I've been grateful for shared hosting

Mateo Ramírez · 0 likes

shared hosting gang finally gets its moment

Rapid Panda · 6 likes

WAF rules from cloudflare landed pretty quick, buys you a few hours if you cant restart right away

Brave Marauder · 0 likes

buys you hours not days. still patch

Huy Le · 5 likes

Dutch NCSC site went down this morning, people were joking its because it runs PHP. too soon

Yasmine El Amrani · 8 likes

they probably just took it offline to patch, which is the responsible move honestly

Paolo Garcia · 3 likes

patched 40 servers before lunch. the fun part was finding the 3 nobody had in the inventory

Maya Williams · 1 likes

the 3 nobody had in inventory are always the ones running payroll lol

Pablo Martín · 1 likes

inventory is just a vibe at most companies tbh

Salma Idrissi · 3 likes

7.4 still in prod here. not patched because there is no patch. cool cool cool

Curious Marauder · 13 likes

thats a sign from the universe mate

Rizky Pratama · 7 likes

you can get extended support from a few vendors, its not cheap but cheaper than a breach

Sleepy Marauder · 0 likes

Honest question, does this affect php-fpm behind nginx or only the apache module?

Minji Kim · 7 likes

advisory says the bug is in the request parsing path so fpm is affected too. dont assume your reverse proxy saves you

Khalid Al Zahrani · 0 likes

Anyone have a quick way to check which minor version is on a fleet? php -v over ssh in a loop feels caveman

Mateo Cruz · 4 likes

ansible ad-hoc with -m command -a 'php -v' and grep. caveman but with a hat

Élodie Favre · 0 likes

osquery if you have it, otherwise yeah loop + ssh, no shame