YHK - yet another hacker news clone

There isn't an easy exploit for this PHP vulnerability

183 points zkldi 3 hours ago 86 comments

pinevale 2 hours ago | parent

I've seen many posts like this. None of them stood the test of time. Ease is irrelevant because you only need expertise once and then everyone can reuse the result.

It's also not easy to pop an iPhone, but reliable, weaponized exploits are available in trade and governments use them in a plug-and-play way.

ameliaquining 2 hours ago | parent

The specific controversy here is about the disclosure timeline. Some people allege that the disclosure and patch release of this vulnerability were mishandled; others dispute this. The dispute turns crucially on how available exploits were during the embargo period. Nobody is arguing that the vulnerability doesn't need to be patched at all. (The PHP core team didn't initially treat it with much urgency, but they've acknowledged that this was a mistake.)

j16sdiz 2 hours ago | parent

I guess the main takeaway is: we (humans? current methodology?) are bad at estimating how urgent a fix is or needs to be.

Gigachad 2 hours ago | parent

Time is the whole point though. Everyone was terrified and shutting their websites down because they believed the exploit would be running wild on the internet in between it hitting git and them being able to update the server.

If it takes a week to come up with a working exploit code, the critical services have time to update.

mrheosuper 1 hour ago | parent

With AI i think it's safe to assume it would only take hours after you give it what/where to look

anonymous908213 1 hour ago | parent

Time is part of the point, but it is not the whole point. The whole point involves the fact that this impacts two decades worth of PHP versions. Even if it took months to exploit, there is going to be a long, long tail of breaches against ill-maintained legacy sites.

ameliaquining 1 hour ago | parent

Yes, but that's not really relevant to the controversy over the embargo.

anonymous908213 1 hour ago | parent

Neither the OP nor any comment in this chain of replies is about the embargo?

ameliaquining 1 hour ago | parent

The controversy over the embargo is why the post was written and why we're talking about this at all.

anonymous908213 1 hour ago | parent

Huh, I thought we were talking about this because it's a massive security breach offering approximately unconditional RCE against half of the servers on the open web.

martinald 1 hour ago | parent

But just because there isn't a working PoC on GitHub doesn't mean there isn't one and things aren't been actively exploited.

If you are a bad actor you probably don't share your PoC around as it means less boxes to hit.

ameliaquining 1 hour ago | parent

You can never rule out the possibility that someone interested in attacking you has a non-public exploit, but it's dramatically less likely if there aren't already working exploits circulating all over the internet.

fomine3 18 minutes ago | parent

It was true before great LLMs era

hannasanarion 1 hour ago | parent

That "if" is load bearing and increasingly flat-out false.

Crowdstrike's average "breakout times", the time gap between a first successful infiltration and maximal exploitation, has gone from days or hours prior to 2024 to minutes or seconds now.

nextaccountic 28 minutes ago | parent

AI makes developing this exploit faster though

asddubs 1 hour ago | parent

ease is somewhat relevant initially, since it determines how quickly you have to patch before exploits start popping up. I would be extremely curious to see if anyone has been pwned by this already, especially before the public release of the patches (not that I doubt it, but I heard some people saying they saw attempts in their logs, but not really enough information to tell whether they were understanding their logs correctly. The situation just seems a bit murky and unclear to me).

amstan 2 hours ago | parent

On the other hand, my local qwen model (3.8-flash-next) was trying to convince me that the eMudhra CA thing is no big deal since you need to be "positioned correctly" (eg: any wifi network) to be able to MITM, and most of the IOT devices would have patched stuff by now.

Tadpole9181 2 hours ago | parent

> So why was everyone so scared?

I think this section misses the mark.

The biggest problem is that for a good 12 hours nobody knew what was going on. All we knew was there is a critical vulnerability affecting all of us that allows RCE somehow and we have to have vulnerable servers open for potentially even longer.

Everyone who knew was being hush hush, only chiming in to say "nah, those workarounds don't work, you're fucked".

So when people started spreading rumors of PoC or when the Cloud flare CTO posted that they were actively seeing exploit traffic - what are we supposed to do?

We aren't sitting there trying to PoC with Claude - we're subscribing to a bunch of news feeds and twitter accounts while we try to prepare for the patch and close down what we can. We're calling executives saying "hey, how much money do we lose by being offline for 6 hours?"

So even if this isn't as easily exploitable as first believed, no one could have known that, because those with the ability to calm us down were seemingly choosing to stoke the fires.

This is (IMO) a failure of the potentially outdated disclosure system that's supposed to protect us. And at the very least a trial run of how the world may react next time, if it really is that bad.

thomasfromcdnjs 1 hour ago | parent

Yeah, I suggested to take down the app someone between seeing the Gina (core) comment (saying php.ini etc changes won't do anything) and after seeing the Cloudflare CTO tweet.

Celeo 1 hour ago | parent

Very well said. Even for non-sensitive stuff that I was told was "super vulnerable", I didn't know if this was a full, actual RCE - some places said yes, others no. Did I need to take down everything running PHP? Just the apps dealing with data I didn't want leaked? Etc.

The rather long delay in getting official Docker images didn't help; we were told "patch now!!1!!" but that apparently meant building from source.

lgl 1 hour ago | parent

Great reply, this hits the nail in the head and is pretty much exactly how I spent my day. Just reading, waiting and stressing while being essentially in the dark about the whole thing.

I'm assuming the next few days will probably confirm if this was mostly FUD or not.

fwlr 38 minutes ago | parent

IMO it is a little bit silly to describe “a system that works well until it intersects with a trillion dollar company’s PR campaign” as an outdated failure.

layer8 2 hours ago | parent

> So why was everyone so scared?

> Because:

[…]

> 3. The exploit video had an anime girl in it

Lol, somehow I had missed this. Since I had to dig a bit for it, here it is for everyone’s enjoyment: https://www.youtube.com/watch?v=pfWZrdzvooc (via https://calif.io/php2shell/#php-5-4-0-rce)

Genego 1 hour ago | parent

Anime girl level cataclysmic security events definitely don't worry me as much as laughing man (笑い男) cataclysmic events; only then it's when I really start to panic.

judge2020 31 minutes ago | parent

What is this in context of? Is the Laughing Man commonly used in (maybe Japanese) hacks?

All I know of Laughing Man in relation to exploits is from a small niche MMORPG called Toontown Online ( https://youtu.be/sGED1WcJhOM ).

unsnap_biceps 18 minutes ago | parent

It was used in a fairly popular anime Ghost in the Shell: Stand Alone Complex.

wocka 14 minutes ago | parent

One of the Ghost In The Shell animated series featured that face you saw in the video you linked.

adiabatichottub 1 hour ago | parent

Also, High Forever track kind of bangs

nerosk 1 hour ago | parent

the awful edit featuring an underage anime girl only exposes the childish, immature behavior of the people handling this situation, which makes this even more terrifying!

postalrat 48 minutes ago | parent

Since when is a 200+ year old immortal considered underage?

yunnpp 1 hour ago | parent

What's up with these weird ass videos with the anime girls though?

citruscomputing 28 minutes ago | parent

It's a normal video, I don't know what you're talking about.

ge96 1 hour ago | parent

the dancing anime girl is UI Shigure

charlesfries 1 hour ago | parent

For anyone wondering, this is the song https://soundcloud.com/marlonhoffstadt/highforever

skoll43 54 minutes ago | parent

If has anime girl, it means is serious

cookiengineer 2 hours ago | parent

[removed]

lukev 1 hour ago | parent

If anything, claiming that this vulnerability has been known and unpatched for 22 years supports the author's point: clearly it's not that easy to actually use.

edoceo 1 hour ago | parent

WAS not easy, now it's much easier.

asddubs 1 hour ago | parent

Do you have any links to a working PoC that appeared before the details were released? I'm seeing a lot of conflicting info, and I'm not really sure what to think. People saying they were seeing people trying to exploit this hours ahead of the patch release on their servers, yet no one who seemingly actually got pwned by it (were people just misreading their logs?)

stuffoverflow 1 hour ago | parent

Glad to be proven wrong but as far as I can see there are no reports of it currently being exploited in the wild at the scale you are implying. It genuinely takes a lot of time to weaponize even with the assistance of frontier LLM models and it is way more difficult when you don't control the server.

I largely agree with the author and it is a common annoyance in cyber security discussions where people make strong claims but have nothing to back it up with.

kgeist 2 hours ago | parent

I ran 2 PoCs from GitHub today: one indeed expected Local File Inclusion (LFI) to already be present (so it's just LFI with extra steps), and the other one didn't work at all out of the box without some modifications (although I used the same Docker images and all). The second PoC did trigger a real stale write bug in the end, but it didn't demonstrate actual RCE; it just triggered a stale write. And then I wondered, is this the first time ever that the PHP runtime has had a memory corruption bug? I doubt it (I remember a few years ago we had random crashes in production under high load due to an opcache bug). And if it's not the first memory corruption bug in the PHP runtime, why is it being proclaimed the worst vulnerability in years?

bunderbunder 1 hour ago | parent

There is an argument to be made that taking down such a sizable chunk of the Internet automatically qualifies it as a pretty severe vulnerability, even if no actual exploits were involved in causing it.

More seriously, though, I read it as bad because of the potential. All versions of PHP going back a full two decades were affected, all users of PHP are affected regardless of which features they use, and it’s still unclear if there’s an effective mitigation. So the blast radius if anyone does/did have a working exploit would have been enormous.

fwlr 50 minutes ago | parent

> why is it being proclaimed the worst vulnerability in years?

Also announced today: OpenAI’s software vulnerability initiative.

ajross 1 hour ago | parent

It's a digression, but FTA:

> When I think about "we're very fucked" CVE10s on the Internet, I think of the following vulnerabilities:

Which is IMHO a really good list. It's also, I think, important to note that every single one of the four items is not at all a memory safety bug. They're all logic, at various levels of an interpretation stack.

I think a lot of folks with their heads down in the security world might have expected the opposite. As is often the case in engineering, the smartest people end up obsessing over solving the less important parts of the problem.

tptacek 1 hour ago | parent

Serverside memory corruption is annoying to get working. As a dominant metagame strategy for attackers, it's much more impactful on the clientside.

(I'm not cosigning the analysis in this blog post. I think "I haven't seen a PoC I could get working" is not the evidence this author seems to think it is.)

theamk 1 hour ago | parent

I think Heartbleed is close enough to memory safety to count. It was caused by memory allocator returning uninitialized memory and every memory safe language I know about does not allow this in best-practice code.

(And sure, there are escape hatches - like Python has "recv_into" that could be used to implement heartbleed if you are really inclined to - but this would not be a realistic python program. In python, even with buffer reuse, you'd be using memoryview or similar that can't have a heartbleed problem)

phyzome 1 hour ago | parent

Heartbleed was a buffer overread. Sounds like a memory safety bug... is it not?

insanitybit 1 hour ago | parent

It was.

redox99 1 hour ago | parent

Huh? Heartbleed is literaly memory safety (buffer over read)

insanitybit 1 hour ago | parent

The vast majority of web services are not written in memory unsafe languages so this is not surprising.

One of the exceptions (with regards to web facing attack surface in a memory unsafe language) is that people still use OpenSSL, which has a terrible history of memory unsafety, including the cited heartbleed.

richardbarosky 1 hour ago | parent

What kind of pisses me off was that there were kind of two sides of the continuum.

You've got the detailed technical writeup on one end in the patches themselves, and on the other end you've essentially got the AI and security companies both together (php2shell) and independently with their highly polished microsites and blog posts with attractive infographics and stylized pitch deck looking images.

Every publication on the other side of the detailed technical writeup in the patches themselves wanted to make it into a huge fucking marketing stunt first and foremost, providing absolutely zero added practical benefit or value.

https://www.php2shell.com/

https://patchtheplanet.org/

https://www.wiz.io/blog/php2shell-php-rce

https://calif.io/php2shell/

anonymous908213 1 hour ago | parent

People mistake OpenAI and Anthropic for AI companies, but they are in fact primarily in the business of marketing, and business is good.

ameliaquining 1 hour ago | parent

Every business is in the business of marketing, that's a meaningless distinction.

taikahessu 5 minutes ago | parent

There's no ai in mrketng.

stickfigure 1 hour ago | parent

> It isn't a Log4J moment.

The difference is that PHP has a long history of vulnerabilities while platforms like Java don't. And as bad as Log4Shell was, it wasn't a problem with the core runtime. It wasn't even a problem with the most popular logging framework at the time.

I wouldn't downplay this.

Insimwytim 1 hour ago | parent

> It wasn't even a problem with the most popular logging framework at the time.

I can't say if it was most popular overall, but it (Log4Shell) was a nightmare for many F500 companies.

bunderbunder 1 hour ago | parent

My employer at the time didn’t use log4j, but we were still plenty vulnerable. All sorts of open source packages we used had a transitive dependency on it.

esikich 21 minutes ago | parent

Was it actually though? I worked at an MSP at the time and our tools were just flagging the mere existence of the library. It either wasn't being used or wasn't exposed in any meaningful way. Oh a dev happens to have it installed on his laptop? Who cares.

bawolff 50 minutes ago | parent

I'd disagree. log4shell was a monster to patch and figure out what is and isn't vulnerable.

upgrading php is much easier.

tptacek 9 minutes ago | parent

It's a weird move for this post to simultaneously line this vulnerability up against Log4Shell (very few serversides are going to measure up to L4S) and insinuate that it's not practically exploitable at all.

If it was just "everyone take a breath, we've been through something worse with Log4Shell", that would make a lot more sense.

bouncycastle 35 minutes ago | parent

Core run time vulnerabilities in PHP, the language and runtime itself, are rare. I remember the days when an exploit in the JVM was a daily announcement. To the point where they had to ban java applets from the web.

Retr0id 1 hour ago | parent

I predict that this take will age poorly.

Insimwytim 1 hour ago | parent

It's also weird that it seem to has overshadowed certificates incident, which, to me, appears to be of at least the same magnitude of impact.

Gigachad 1 hour ago | parent

The certificates incident was mitigated by the fact it was revoked within hours so by the time people found out, it was resolved.

Yes there is a long tail of Internet of Shit devices that have a fixed non updated cert store, but these devices are being absolutely ripped to shreds by AI from all angles already.

cesarb 1 hour ago | parent

It's not just IoT devices. It's also a very very long tail of programs which for some reason have their own copy of the CA certificates list, either because they don't trust the system's one, want to work identically on all platforms, have a severe case of not-invented-here, or all three at the same time (looking at you, Java...)

Insimwytim 53 minutes ago | parent

  Most non-browser TLS clients (so basically everything else, with default settings), things like curl, Python, Node, Go, Java, git, package managers and every script and daemon you've got, do three things that matter here: they trust a CA bundle on disk, they don't check revocation by default, and they don't check CT. So the fact that eMudhra and Sectigo have revoked these intermediates doesn't help them at all. [1]
[1] https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-key... ( https://news.ycombinator.com/item?id=50177916 )

hn773746483 1 hour ago | parent

Social media and "cybersecurity experts" had a big role in this. Stuff like "EU SAYS THIS IS A URGENT VULNERABILITY" and even the Prime Minister of Japan doing a nighttime PSA. They cite "the experts" posts on social media about the initial advisory, while the very same so-called experts share google search AI output mitigation strategies. None of these organizations or bodies had any details other than what was on the advisories and social media. (e.g "CVSS 10, that's bad!!")

To me, it seems more more akin to broadpwn, technically severe, wide scope (millions of iphones), yet will never be a one-size-fits-all-PWN-button.

Even in the age of AI, I don't think this is going to be weaponized down the line like how Eternalblue was... but I'm not the social media cybersec guy with 15000 followers, so don't take my words at face value ;)

iaaan 6 minutes ago | parent

I feel like half of working in the cybersecurity industry is just cultivating your social media persona. It's bizarre. I left a viral up-and-coming startup over it. It was mixing into everyone's personas at work in weird and uncomfortable ways, as someone who doesn't use traditional social media.

commandersaki 1 hour ago | parent

My take:

I have had this take but for things like exploiting with a DRAM interposer ala Battering RAM. They say it's a low cost attack, but the amount of obstacles you need to overcome (including having root on the system and physical access) is intractable to virtually everyone, and a nation state wouldn't go to that kind of gymnastics when it is more than likely there is a quicker and easier way in.

But this? I doubt any high value targets will be exploited in the wild since news travelled fast and from what I can see pretty much most took preventative action. Looks like pretty much everyone heeded the warning and suggestions. It'll mostly be a nothing burger like Heartbleed. There'll be of course low hanging fruit of unpatched servers out there, but anything of importance would have already had active maintenance and patching.

Now that Calif has released the details, I'm sure there'll be a contingent that can actively and easily exploit this, either now or very soon, with or without the guidance of LLMs.

But yeah if someone said Battering RAM, I would say fuggedabout it, but if someone said PHP vulnerability with a CVE of 9.2, I would say patch it ASAP or bring the servers down until you can.

zer00eyz 1 hour ago | parent

> but anything of importance would have already had active maintenance and patching

Mostly because people either "did it" or yelled long enough and loud enough that it "got done". There is a saying about horses and water, but some people needed to be dragged, kicking and screaming and have their faces shoved in the well.

When headlines like "there wasn't an easy exploit" come out I have burned a lot of good will, on what people will perceive as "nothing burger". The security space has a knack for making a complete mockery of itself and then wondering why no one seems to give a fuck.

"I'm getting too old for this shit" really does apply to today.

0xbadcafebee 1 hour ago | parent

RCE is incredibly dangerous not because it lets you execute arbitrary code, but because it lets you execute some code. Code you're not supposed to execute. As soon as someone can do that, all they have to do is probe until they find something to chain.

Almost every system on the internet has some local code you can chain to gain root, or a way to put some in place. It gets worse when it affects legacy systems, because they're the bastard stepchild of security. RCE on a box that hasn't been patched since Obama's first term is what little blackhats' dreams are made of. And developers are way too lazy to intentionally design their apps into different privilege domains to protect against chaining. Unless your app runs chroot() (is my neckbeard showing?) or in a container with nothing but a Go binary, somebody can LFI it.

A crack in the door is plenty of space to get a crowbar in (especially with interpreted languages).

easterncalculus 1 hour ago | parent

Related LiveOverflow video about fake exploits going around https://www.youtube.com/watch?v=7CiZmq2llDg

That said, OP is basically full of shit. This is absolutely exploitable and people are going to just assume the platform and ABI and spray it against the internet, particularly hoping for mod_php.

noduerme 32 minutes ago | parent

Aren't most PHP sites out there running mod_php anyway?

1over137 17 minutes ago | parent

>This is absolutely exploitable...

OK, can you share a working one so we can test that our servers are fixed?

rectang 57 minutes ago | parent

According to "Today's PHP Security Release, and How We're Strengthening PHP Security" discussed at https://news.ycombinator.com/item?id=50182987

* Regarding one CVE, "Remote code execution was also confirmed on PHP-FPM through application-level code paths."

* Regarding the other CVE, "A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php."

Since those exploits exist, I expect that LLMs will duplicate them soon.

tamimio 56 minutes ago | parent

>script kiddie

Get on time, pa, they are called LLM kiddie now

nprateem 51 minutes ago | parent

Clickbait bullshit from Internet nobodies.

https://www.ft.com/content/245778d9-597b-492d-b5b6-a2967c77e...

noduerme 45 minutes ago | parent

OP seems to be implying that there's no way the UAF bug could be used to run arbitrary code with higher privileges than PHP itself, on a vanilla installation. I couldn't divine that from reading the CVE. Is that true...? Is that why you'd need PHP to exec an existing file or something? Or is that assumption just based on the fact that the PoCs so far rely on nerfing PHP? If the latter, it's a bit ironic to complain about everyone's judgment skewing toward Claude's while using Claude-generated code not doing it as circumstantial evidence that such a thing can't be done.

I'm no expert on UAF exploits. I guess one thing I'm wondering is whether the pointer to "freed" memory in this case is still pointing to memory reserved by the system for a PHP process, or if it's some address that's truly free and could be picked up by another process.

minitech 23 minutes ago | parent

> or if it's some address that's truly free and could be picked up by another process

This isn’t a thing; virtual memory (https://en.wikipedia.org/wiki/Virtual_memory) is very old, and Linux has never not used it. It takes a separate vulnerability (a “local privilege escalation”) to do what you’re getting at. (However, those are plentiful, and arbitrary malicious code with PHP process privileges is often already catastrophic for a web service.)

That said,

> OP seems to be implying that there's no way the UAF bug could be used to run arbitrary code with higher privileges than PHP itself

No, nowhere does the article imply that at all.

nickysielicki 41 minutes ago | parent

Docker images from Wordpress, joomla, and drupal were all exploitable.

https://www.wiz.io/blog/php2shell-php-rce

Chaosvex 7 minutes ago | parent

Name a more iconic trio when it comes to exploits.

0x1F8B 24 minutes ago | parent

If they're so confident this isn't exploitable this person should stand up a very basic nginx running php-fpm server running in an exploitable version of PHP and invite people to exploit it.

jadar 22 minutes ago | parent

I am so annoyed… I am trying to verify the claims of this article with my friend Claude but daddy Dario won’t let me because “cyber”. I pointed it at this article and a PoC [1] I found on DuckDuckGo. We live in a stupid world. I can’t run it right now so I am trying to figure out if it’s serious.

[1] https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-...

furyofantares 7 minutes ago | parent

The only other post on this blog is "Anything connected to the internet is going to get hacked to pieces." I'm not claiming any contradiction but it is funny.