Login
You're viewing the social.telemetrydeck.com public feed.
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Oct 23, 2026, 7:55 AM

    If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.

    Image attached toot
    💬 6🔄 1⭐ 0

Replies

  • Kevin BeaumontGossiTheDog@cyberplace.social
    Oct 23, 2026, 7:59 AM

    ASLR supporting PHP exploits are coming, probably next week.. but it’s a really good security control (from decades ago) you should demand your vendors actually enable as it enabled time for orgs paying attention to patch.

    The cybersecurity vendor industry itself is essentially negligent when it comes to this stuff. infosec.exchange/@catc0n/11748

    💬 3🔄 3⭐ 0
  • 💬 1🔄 2⭐ 0
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Oct 23, 2026, 12:29 PM

    PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.

    The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).

    Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.

    Image attached toot
    💬 10🔄 17⭐ 4
  • 💬 4🔄 1⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • George Bgbargoud@masto.nyc
    Oct 23, 2026, 12:44 PM

    @GossiTheDog

    So what Meta (who famously [edit: used to] use PHP extensively in what used to be their flagship product) spent on the complete failure that was the metaverse (~$60 billion) could have funded them at current levels for close to 100,000 years

    💬 0🔄 2⭐ 16
  • Markus StollMarkusStoll@sueden.social
    Oct 23, 2026, 12:55 PM

    @GossiTheDog
    Sure, but they knew about this since 2024!
    So the main issue still is bad judgment on security here, as they invested their time and money obviously on other issues since then…

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • Markus StollMarkusStoll@sueden.social
    Oct 23, 2026, 1:03 PM

    @GossiTheDog
    I strongly doubt that there was a bigger issue than this, as this makes it very clear to everyone that you should avoid using PHP.
    Still I concur, that whoever uses it, should contribute to this…

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Corsaccorsac@mastodon.social
    Oct 23, 2026, 1:06 PM

    @GossiTheDog and to be honest they're not the worst ones. At least they do have a budget, and core developers on the payroll. And many thanks to the @sovtechfund for that audit financing in 2024!

    💬 0🔄 0⭐ 0
  • 𝙳𝚢𝚕𝚊𝚗closingtags@mastodon.social
    Oct 23, 2026, 1:10 PM

    @GossiTheDog It is unreal that over $85k didn't reach the team because of fees!

    For such thankless work (you know these processing companies are benefitting from PHP somewhere in their business), you'd think we could get them to wave some fees.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • fuzzyfuzzyfungusfuzzyfuzzyfungus@cyberplace.social
    Oct 23, 2026, 2:37 PM

    @GossiTheDog When the newest PAN-OS version is rocking PHP 8.0.30 I assume that they've got themselves into a delightful backport hole.

    An entirely predictable one that is their fault, of course.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Trebachtrebach@functional.cafe
    Oct 23, 2026, 6:05 PM

    @GossiTheDog I bugged QNAP about 2 hours after the patch was released. I only got a reply today from an account manager that he is checking with the technical team on the timeline for updated firmware that would have the fix.

    I am not plugging the box back in until they have updated firmware with the fix

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • David Chisnall (*Now with 50% more sarcasm!*)david_chisnall@infosec.exchange
    Oct 23, 2026, 10:27 AM

    @eloy @aetios @GossiTheDog

    ASLR adds work factor for attackers but there are a bunch of ways of breaking it. The Blind ROP attacks, for example, are easy to automate. In practice, it's often possible to leak a pointer.

    I really hate the naming because there are two different techniques whose names are the wrong way around. Address Space Randomisation (ASR) was first (I think?) shipped in OpenBSD and randomises each mmap call. The layout of the address space is random. Address Space Layout Randomisation came from the Linux PaX project. It gives a deterministic layout but with a random base. This is nice for deployment: ASR suffers from the problem (especially on 32-bit systems) that the random addresses may be sufficiently fragmented that a later memory allocation fails because there isn't a sufficiently large contiguous space, but it works the next program invocation with different layout.

    With ASR, leaking one pointer lets you determine the addresses of all other memory locations in the same region (shared library, malloc bucket, whatever). With ASRL, leaking one pointer is sufficient to determine the location of everything. It turns out it's really easy to leak one pointer. This is even worse for KASLR because your adversary (userspace) has a rich API surface that was never designed on the assumption that kernel addresses were secret (because the MMU means that you can't use a kernel address, even if you know one) and you just need one.

    The thing that's changed here seems to be LLMs. Now, rather then using exploit toolkits the include automatic mitigation bypass steps, script kiddies are just asking Claude to produce an exploit. And Claude is doing what LLMs normally do: produce output that looks correct according to a statistical distribution of text. When used in an 'agentic' model, it keeps trying to do this until it finds one output that actually works in the specific conditions that the agentic loop is set up to test. It turns out it's not just nature that can build a better idiot, Anthropic is competing hard in this domain.

    The other dimension in this spectrum is the cost. ASLR is basically free. The kernel complexity is tiny (I think the FreeBSD patches had under a hundred lines of functionality change, most of the code was the extra controls for turning it on and off - you really want to be able to turn it off in debuggers, for example, so that your program runs are deterministic, and ideally you want to be able to capture the random seed and replay it so that your debugger can see the conditions that your fuzzer triggered). It also doesn't change the programmer's abstract machine significantly, so if you remove it in the future it won't break things.

    If it adds any work factor to attackers, you may as well turn it on because it will at least prevent the least competent ones. And it's embarrassing if your system can be compromised without any effort.

    💬 0🔄 1⭐ 9
  • 💬 0🔄 0⭐ 0
  • Viraptorviraptor@cyberplace.social
    Oct 23, 2026, 10:24 AM

    @GossiTheDog
    It's always such a surprise when someone you respect has a dumb take... But then I remember that there are likely so many dumb takes of mine on the internet 😂

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0