Mass hysteria, or something.

I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796

Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?

Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites

  • INeedMana@piefed.zipOPEnglish
    11·
    9 hours ago

    Yes, but from the page I linked

    One really amusing thing in common with most of these "PoC"s is that they lean on “LFI”, or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

    It’s not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

    For sure that this is still a bug that should be patched. But I do remember “don’t eval on user sent stuff” rule. Or is this really prevalent in PHP ecosystem?

    • realitaetsverlust@piefed.zipEnglish
      2·
      3 hours ago

      Or is this really prevalent in PHP ecosystem?

      Not anymore.

      You used to see eval a TON in like the early days, with like PHP 4 and 5. People just weren’t very experienced and PHP in itself had it’s limitations, and people worked around those by utilizing eval.

      But modern PHP code rarely ever uses eval. Modern toolings like PHPMD even flag eval as an error, causing it to fail a pipeline if used in one. If you find eval in a codebase today, it’s either a badly modernized legacy one or written by a retard.