Operyl

Atlassian products (Jira Server) are no longer supported, and their more Enterprise offering dies in 2029, so everything is ending up in their cloud now yeah.

> my now former CPA

Assume yes, fired.

There are backports already.

Look, at the end of the day, every major security researcher is going "oh shit" and no amount of tweaks to your configuration is going to limit the blast radius in a way that will actually matter. You're going to need to update PHP, that's the _only_ solution to this problem.

The current PoC in the public gets there via that method, and even then you don't need to call system() alone to cause hell on a host...

If your PHP application accesses a database, you've got exfiltration, it doesn't matter in this case. Unless your PHP application is just echoing non sensitive data (i.e. rendering md files)...

I can guarantee you that it's not because someone left system() enabled, it's much lower than that.

I love the "affects PHP... 6" given we never had an official 6 release haha.

It's a RCE bug, it does not matter if you disable php functions. It's not arbitrary PHP execution, it's an exploit chain resulting in arbitrary code execution.

I don't see any details of the vulnerability leaked except "code execution"...?

Where?

My municipality does! Guess what they still don't really use... most of it still ends up on X exclusively.

The biggest frustration for a lot of people is that their municipalities use Twitter almost exclusively to communicate with their constituents, it _sucks_. I've pleaded and begged my city and county to have some other form of communication, in addition to Twitter/X, to mass distribute information.

A woman can dream!