ericol

Ha. Well, your message did send me through the WAF route myself, and with the help of Mythos (Yeah, I know) I managed to craft what appears to be a solid set of rules for Nginx that we ended up not using.

Besides that, also with Mythos I managed to build PHP 5.6.40 for Jessie (Don't ask) but that's an entire different story (we ended up force upgrading to Bookworm, and there's a huge silver lining for us with that anyway)

Which tests, and against which PoCs? The public php2shell kits already crash workers on stock 8.4 (8/8 crash, 0/8 shell) — so "turned into DoS" may be the status quo, not your result.

And firing the OOM is memory_limit working as designed, not exploiting a system.

Pix, or GTFO.

Preach, brother.

There's a difference between walking on the woods at night blind, and with a 20K lumens torchlight.

A successful universal exploit is all about making it land on the correct memory address for each set up, and that is nigh impossible.

As was stated by many groups that do this for a living (E.g., Crowdstrike) "PoC yes, RCE no"

Every single group I read published with the same caveats "RCE _in our labs_" as in, they knew a lot regarding the configuration of the system. Wiz themselves had an article out last week that stated "AI written, tread carefully" and almost all of them made no effort on distinguishing how the 2 vulns operated (Or, differed)

> claims they have an "universal" exploit

That's not correct. He claims they have A exploit. Based on the nature of the vuln, I assume every one that works in the are would be very careful to claim a universal exploit, and the comment by Mr. Guido seems to be align with that.

> This looks like a trap. We have a working RCE that would claim this, but I don't want to demonstrate that because it might leak what we built to others. We still have a window for people to patch and I don't want to risk that.

So what he seems to be saying (My interpretation) is "I don't want to demonstrate thus risking giving ideas to other people regarding hhow to build exploits"

The steal my bitcoin exploit works for a specific stak, and that is the reason why the person that set that up did publish certain information in the site itself (reduced phpinfo)

Care to share it? Still trying to convince my provider to go this route...

The very first line in the repository says:

> Any window from your Mac, on your iPhone and iPad.

I don't think it can get any more clear than that.

I'm from the area where this happens (My city is actually named in the article).

Can confirm that this is, effectively, a staple of normal life around there. Calling it "the first social network" made me chuckle.

Younger generations might not be aware of this mostly due to reduced AM radio audiences, but my daughters (3x ~30 yo) do know what this is about.

yeah no thank you. There's no way in hell I am going to share with you any sort of document.

Both Player of Games and Use of Weapons are incredible good books.

I was actually surprised when I finished UoW regarding how different it was from PoG, while maintaining the quality (If not better, but PoG IS THAT GOOD anyway).

For the record, the series was recommended to be by Claude of all things, and it told me that Phlebas was not up to quality but I gave it a shot just for the sake of completeness of the series. Nop, not worth it.

It was book 3 precisely that held me down. It was too long, and kind of lost the pace of the previous 2 books.

It was too repetitive.

> people will soon *stop paying

Think you missed a word there.

Somebody somewhere here gave a list that had "consider Phlebas" in it.

That particular book bored me to death, but from the same author / series I recently read "Player of Games" and "Use of Weapons" and I can't recommend (both) enough.

Dungeon Crawler, I started the series recently but got bored mid 3rd book. It is quite more denser than the first 2, and it feels like never ending.

So we're back to clippy now, LLM powered.