Mass hysteria, or something.

I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796

Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?

Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites

  • spankysalmon@fedinsfw.appEnglish
    94·
    21 hours ago

    The PHP vulnerabilities (yes there is more than one) are relatively easy to exploit if you can fiddle with what requests your server receives (easy).

    The DNS exploit requires someone to figure out how to man-in-the-middle your connection. While that is trivial for governments, it is much less likely to be done by purely bad actors, simply for how hard “internet” integration is and how visible the problem ends up.

    Both are big problems, but only one of them is continually exploitable, as the DNS issues have been largely resolved even before the very public disclosure.