PHP dropping another security advisory, just two days after the last one. October is getting interesting for PHP
Is it AI agents finding these exploits ?
PSA: Critical PHP vulnerabilities
- Thread starter Naz
- Start date
Is it AI agents finding these exploits ?
Most probably.. Yeah
Well you can improve your server setup. I have done the same. None of my clients servers can be accessed in such way. Even control panels are behind firewalls.
On shared hosting, you can set up a cloudflare secret header word, with it's counterpart word and password in .htaccess. If anything goes direct to the origin, without going through cloudflare, it doesn't have the secret header, so gets blocked. @MentaL
Excellent tip given to me by @badabugs1
I believe it was published that that was the case. Linus Torvald published some weeks ago, AI helped them find exploits in their kernel from decades ago. All this time, linux kernel with 3 exploits and AI found it and closed it. Never to late I guess. I only use PHP on one server, so it was an easy fix for me.
Wiz used AI to find the exploits but the worst part is the security industry idiot who posted the exploit details to Hacker News before it was announced and a security company called Chainguard who released the patch 6 hours early to their paying customers and the patch was reverse engineered before they realised the trouble they caused.
AI found it and human commercial greed and someone getting internet points for their post put PHP group on overdrive to sort it out.
Last edited:
Similar threads
