This is and update on the php2shell vulnerability and a response to the blog post from https://lemmy.world/post/53441818 : https://eliastaylor.com/noexploit/
This is and update on the php2shell vulnerability and a response to the blog post from https://lemmy.world/post/53441818 : https://eliastaylor.com/noexploit/
So it seems like it was rather easy for an IT security professional to create an exploit within 24h of the disclosure. Not sure if every script kiddy can do it, but this means that there are certainly malicious people/organizations who can.
Ultimately, it seems to me that the only real choice is to patch our (public) systems ASAP these days.
Besides the problem of people being able to do this themselves, there’s the problem of people who develop and sell, or sometimes give away, exploits. The people scrambling to publish POCs without verifying that they’re demonstrating the right vulnerabilities are unintentionally helping out by making it difficult to find how to exploit the real vulnerabilities. Like what are you supposed to search for “php2shell exploit for real not fake?” You almost need an AI agent in a sandbox to download and run all the POCs to weed out the fake ones until one of them becomes well known.
Agreed.
Sounds like a good malware vector to target security researchers…