Oct 24, 2026, 10:41 AMmore or less confirms that the PHP exploit on Wednesday was overblown, and contrary to claims it would be exploited in 15 mins, we haven’t even seen one confirmed exploit yet. even proof of concept exploits are incredibly hard to write and deploy.
AI companies were lying. again
Oct 24, 2026, 7:06 PMThere are people replying saying it’s still a real vulnerability.
Yes, it probably is. But it’s not the instant easy server pwn we were told it would be. If it were, we would be seeing botnets built of servers taken over by this exploit, WordPress sites vandalized by script kiddies etc. within hours of the leak.
That’s what happened with Shellshock, which was an insta-pwn for a vulnerable configuration of e.g. Apache.
That we’re not seeing anything like that here should tell you something.
A sufficiently dedicated attacker could probably use these vulnerabilities to probe at a server for a few hours or days and eventually have a remote shell. But even if someone has done that, we haven’t seen any confirmed attacks that are suspected to have used this vulnerability.
@dpk makes you wonder who leaked the vuln before the embargo
Oct 24, 2026, 12:40 PM@dpk I read an article yesterday that states its mostly being blocked by aslr. and that a bypass is possible just significantly more difficult.
take this with a boulder of salt though, as its from a security company.
my general understanding was that e.g. debuggers mess with aslr, so an expliot that works on a devs machine might still fail on a prod deployment
Oct 24, 2026, 12:41 PM@dpk ah I wanted to include the article https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883
@dpk@stodon.swhack.com Meanwhile, no one talked about the emudhra intermediate CA leak in the news, and that was a real zero day that was severe enough go kill their business. Or the OTP bypass that I saw on their management site making it trivial to leak any of their keys... That one wasn't even mentioned in their announcement. I don't even think they know about it.