literalAardvark

It'll be done in 6 months with a cots harness.

Being a mess isn't a problem when you have more than 6 items context.

Defining the legacy bugs and porting them as features during the rewrite is actually one of the most difficult parts of enterprise rewrites.

You don't get to pick what parts of the API you're porting during something like that, it has to work the same or some of the ecosystem around it will break.

Thanks, and also, wow.

Edit: I misread the graph. It's the actual number.

(Love the cheeky exponential right past the end of data at the end of a straight line.

Forecasting 501: forecasts say the boss is smart)

Depends which part: php2shell does what it says on the tin: lets you run arbitrary commands as www-data.

If you want more than that you need to chain an LPE. Which are plenty these days sadly.

There's nothing separate about this.

Chained just means they used php2shell to run a local privilege escalation.

The CVE was not overblown. It's correctly marked as a 9.2.

Random bloggers jumped on it and said dumb blogger things. That is all.

This is one of the worst vulns ever and the security response from the people who actually secure things for a living was entirely warranted regardless of whether some blogger thought it was the AI apocalypse or not.

Under normal configurations the server is highly exploitable.

It's a horrible vuln and I don't understand what's with all the flat infosec society coming out of the woodwork.

The challenge server had vibe coded infra that made it hard or impossible to hack, but it was a configuration that can't be used in production and no one uses ( it was deployed as a PHP static content server instead of a dynamic site generator )

They're not great.

LiFePo4 however is excellent and reasonably low cost these days

Well, it's true that serving static HTML through the PHP dev server is a mitigation.

Unfortunately that's only enough to serve a static site and definitely not why or how anyone deploys PHP.

The exploit requires oom and a full connection pool to pin yourself to a thread.

Trying to scale this vertically is hilarious.

MS ended paid extended support for Itanium, so it's kind of a dead target

They have the supporting code for using a key, I'm assuming they don't have in band bruteforce since it doesn't usually make any sense at all

In short, because DHH hates programming in Rust.