One problem though, I've personally seen this exploit be successfully used against Vanilla PHP instances in the wild.
Real containers, running PHP 7.4 or 8.1 or even 8.4; exploited and compromised.
Yes, this is more difficult to do than log4shell. So we won't see the army of Metasploit bots like we did in 2021. But it's still very much a real threat.
One problem though, I've personally seen this exploit be successfully used against Vanilla PHP instances in the wild.
Real containers, running PHP 7.4 or 8.1 or even 8.4; exploited and compromised.
Yes, this is more difficult to do than log4shell. So we won't see the army of Metasploit bots like we did in 2021. But it's still very much a real threat.