This is and update on the php2shell vulnerability and a response to the blog post from https://lemmy.world/post/53441818 : https://eliastaylor.com/noexploit/
This is and update on the php2shell vulnerability and a response to the blog post from https://lemmy.world/post/53441818 : https://eliastaylor.com/noexploit/
Don’t people use unattended upgrades? Crowdsec’s WAF AppSec or Cloudfare’s WAF also put out patches that would’ve caught these vulnerabilities before the official PHP patches were released.
Of course, those normally run once per 24 hours, which is a little late…
The path to uptime is paved with understanding what broke and when.
php can be a real nightmare even with it’s well-attended upgrades :)
Well, we’re talking (Debian’s) security updates only here, not major PHP version jumps. :)
No. Unattended upgrades are a nightmare in production. If you patch stuff manually or even with ansible, you can see what the hell broke during the upgrade. Whereas with unattended access you walk in Monday morning with half your systems down and no idea which update broke it.
Yeah, for businesses I can see that, but selfhosting, meh. I have just one personal server firewalled and Wireguarded, so the PHP vulnerability wasn’t even publicly exposed. Even so, I have never had any issues with Debian’s unattended security upgrades in the last 5 years.
In enterprise environments with a hundred servers, though, you will want to do something else than I do. :)
But even then, don’t enterprises run a good WAF in front of their public web sites that would have received the patch automatically?
For professionals and buisnesses, I see where you are coming from (although there is an argument to be made for prioritizing security over uptime whenever acceptable).
But for selfhosting/private users? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don’t notice (i.e. don’t need the service) than having open vulnerabilities when a fix exists.