A lot of people in techny internet spaces online are talking about a PHP embargo. What does that mean and what's going on?

you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 5 days ago* (4 children)

The ratings seem to be overblown, however. This is nowhere near some of the vulnerabilities people have compared it to, like heartbleed or log4shell

  • source
  • parent
  • hideshow 4 child comments
  • [–] 12 points 5 days ago (3 children)

    The leaked info incorrectly called it a 10 so people are acting like a 10. But an unauthenticated RCE is always a big issue.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 13 points 5 days ago* (2 children)

    It's an unauthenticated RCE in very specific circumstances under particular configurations. We haven't even seen functional exploits in the wild yet.

    edit: more info (albeit from a single researcher) here: https://eliastaylor.com/noexploit/

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 5 days ago

    The fact that I haven't heard of any major webservice involuntary taken over so far makes me increasingly skeptical, though I can also attribute it to preemptive action, partially. I presume an exploit chain might come in concert with some other insecure configurations or some malware developed eventually, but it wouldn't be the first CVE with inflated scores in recent years.

  • source
  • parent