So, yeah, this aged like milk. There are now multiple posts from vuln research teams all of whom have working RCE POCs against unmodified PHP applications.
I don't really understand the intent behind a post like this. Sure, this is a harder vulnerability to exploit than Log4Shell. Everything is harder to exploit than Log4Shell. How, exactly, is that meant to weigh on people's decisionmaking?
For the first time, I think, in my whole career, I saw sites yesterday go down instead of trying to mitigate an unpatchable critical vulnerability. They took the availability hit rather than putting their users at risk. Finally. What purpose is served by trying to dial back the concern?
If this was a long nerdy post about exploitability, I'd get it. But it's not. It's essentially a high-level comparison of logic vulnerabilities to memory corruption vulnerabilities. What is this argument for?
I don't really understand the intent behind a post like this. Sure, this is a harder vulnerability to exploit than Log4Shell. Everything is harder to exploit than Log4Shell. How, exactly, is that meant to weigh on people's decisionmaking?
For the first time, I think, in my whole career, I saw sites yesterday go down instead of trying to mitigate an unpatchable critical vulnerability. They took the availability hit rather than putting their users at risk. Finally. What purpose is served by trying to dial back the concern?
If this was a long nerdy post about exploitability, I'd get it. But it's not. It's essentially a high-level comparison of logic vulnerabilities to memory corruption vulnerabilities. What is this argument for?