Internet Security: We're Doomed

5 points by DamnInteresting2 days ago

2 comments

elmer22 days ago
While the PHP vulnerability is big news and needs to be patched, it's not that easy to exploit.All of the POCs I found have hard coded memory addresses for the heap overflow and won't work for many versions out-of-the-box.
- pizza23439 minutes ago
 > it's not that easy to exploit.With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters.The related public challenge (<a href="https://github.com/KillaBoi/StealMyBitcoin-PoC" rel="nofollow">https://github.com/KillaBoi/StealMyBitcoin-PoC</a>) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.
- onion2k46 minutes ago
 The point is that it's getting a lot easier to find security holes that people would be unlikely to spot. They might be hard to exploit, but when they're not it'll be a massive problem. We can't exactly assume they'll all be difficult.
chasil39 minutes ago
PHP is not prominently used in banking.It is a common technology, well supported in the Red Hat family, and (I would hope that) dnf update will be the proper step for most people.