🚨 UPDATE: A public PoC demonstrates RCE on PHP 8.5.12, even after the October 21 security patches.
The attack is separate from the patched php2shell CVEs and requires specific session configurations and application weaknesses.
Our earlier concerns about PHP session handling remain relevant.
We've updated php2shell-protection with additional hardening guidance.
#php #cybercurity
https://t.co/UAHmYdVr7V
@RigasPP@Murr_berg@EdvardsRatnieks Vai soda piemērošanā ievērots samērīguma princips? Vadītājs pildīja CSN 26. punktā noteikto pienākumu dot ceļu, netraucēja sabiedriskajam transportam, neapbrauca sastrēgumu un atgriezās savā joslā. Vai izvērtēta manevra faktiskā bīstamība, nepieciešamība un soda samērīgums?
@PhiloGroves It would be a bit more complicated. www-data would not permit that. It would need to discover a host specific privilege escalation vulnerability and exploit that as well.
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
https://t.co/L5UcCtwFn3
@ernestsd Nu parasti nav tādas atlaides :) Es ņemtu pie LMT (garantija garāka). Cenas: M5 24GB 1TB - 2498E, M5 PRO 24GB 1TB - 3027.99 Single Core performance identisks, bet multicore jaudīgāks, lielāks ram bandwith un vairāk GPU. Dēļ tā single core ikdienā būs tikpat ātrs.