Oct 23, 2026, 7:58 PMMorning fedi, is there any confirmed exploitation of the php vuln yet?
- Oct 23, 2026, 7:58 PM
Replies
XCondExconde@chinwag.orgOct 23, 2026, 8:02 PM@hailey according to https://mastodon.social/@fastlydevs/117491327351931422 there have been lots of scanning, some exploit attempts, but they can't tell successful attempts from failure at the edge.
- Oct 23, 2026, 8:04 PM
@xconde I don’t put much stock in ‘attempts’ given that none of the pocs actually work, and the cloud security vendors have every incentive to inflate this number. I wanna know about confirmed exploits because only those can sort truth from fiction
VissViss@mastodon.socialOct 23, 2026, 8:01 PM@hailey in lab environments, yes. i have several
- Oct 23, 2026, 8:05 PM
@Viss in the wild though? There’s so much php out there that surely we would expect to see it
- VissViss@mastodon.socialOct 23, 2026, 8:07 PM
@hailey ive seen only as much as you have - lots of squealing and frothing, lots of arm waving, but not like, mass exploitation. i figure folks are finding the same thing I am - this stuff is pretty narrow, the video showed nginx attacks were possible but didnt leak enough intel to make it easy. ive been doing guided fuzzing for two days now and im seeing rce in my lab environment but i havent just tested in the wild yet. each os/php combo has a specific vector