Mooty
Joined 11 years ago
Karma
61
Submissions
43
Member since
Mar 15
Great technical wizard at bluesecure.io
View on Hacker NewsRecent submissions
Comment · 11 days ago
After digging a little in the PoC code (here https://jackalsyn.com/posts/php-up-2026.html) I'm quite confident it's not a completely working one.
It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.
This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.
But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.
Comment · 11 days ago
After digging a little in the PoC code (here https://jackalsyn.com/posts/php-up-2026.html) I'm quite confident it's not a completely working one.
It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.
This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.
But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.
Comment · 11 days ago
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
Comment · 11 days ago
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
Comment · 1 month ago
How do they even test this on a model ? I mean it's a multimodal i get that but response time are too big or am i missing something ?
Comment · 1 month ago
Agree as well he has lost his mind in the battle and does not appear to be trustable in such a competitive market at current state of things (well .. ai).
Probably a good move to move on with someone else that doesn't need to get microdosis at burning man yearly to get ideas.
Comment · 1 month ago
I created a cute minecraft spinoff for my son out of his origins (french/thai). All in browser, works on desktop tablet and smartphones. Localised in english and French.
He is loving it right now.
Comment · 7 months ago
Happy to see no one cares but anyway github is here https://github.com/mdrbx/nerv-ui
Comment · 1 year ago
Did you use any library to go from html to json ? Did you have any inconsistensies with stuff like "<div>text<span> is <span> really</span><b> difficult to convert to json</b><span></div>" ?
I think using 3rd party API might help with latency as they won't have the same latency problem.
Comment · 3 years ago
I've copied a project that basically sends a message to telegram with informations when someone connects on a linux server.
But this time it's for MS Teams channels, which is possible through Webhooks.
I thought that might be interesting for other persons so I share :) It can probably be adapted to any other webhooks, as soon as webhook urls accepts the JSON sent.