90
There isn't an easy exploit for this PHP vulnerability (eliastaylor.com)
submitted 2 weeks ago by to c/selfhosted@lemmy.world
30 comments fedilink hide all child comments
 

I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796

Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?

Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn't from reading news sites

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 2 points 2 weeks ago (1 child)

That is my understanding too. But then when I was reading the article, there was a line somewhere that in order for the exploit to be successful, the server needs to be using eval

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 day ago

    Literally the first thing indo after installing PHP is disabling the eval and assert functions.asssert() might might be useful in unit tests but thats about it, but eval is just plain evil and should never be used and if you do you are doing whatever you are doing, wrong.

  • permalink
  • fedilink
  • source
  • parent