React on Rails HN RSC Demo

devttyeu 8h ago

@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.

CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.

Speculation is that the affected subsystem runs before any application code and affects all default installs.

extraduder_ire 6h ago

@dang is a no-op, you need to email him or the hn@ycombinator.com address

samueloph 13h ago

Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.

nullbio 6h ago

It's already been found and shared on X. It's only a matter of hours before untold numbers of sites are hacked.

beberlei 13h ago

It was leaked

Operyl 13h ago

Where?

walth 12h ago

Here

https://news.ycombinator.com/item?id=50167754

Operyl 12h ago

I don't see any details of the vulnerability leaked except "code execution"...?

tossit444 12h ago

It got flagged already, can't see it.

solyin 12h ago

Whew! Imagine if the details were documented in the clear on HN for anyone to see.

Numerlor 9h ago

Well this is about as bad as it gets, so I guess the internet will get a bit of test and old forums will turn into a botnet

potaytopotahto 8h ago

Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off

qingcharles 5h ago

Sadly this says it's probably not enough:

https://phpc.social/@Girgias/117476477429221001

bpbp-mango 5h ago

session.use_strict_mode = 1 as well. some advice around disabling multipart uploads too.

EGreg 7h ago

I have heard Kirill Firsov say that, but does anyone even know the vulnerabilities? Could be a meme.

potaytopotahto 7h ago

Yes its two hanging pointers related to the upload progress handler that can be used for RCE after some heap grooming, disabling upload progress means that the function that contains the vulnerable code never runs.

unethical_ban 6h ago

Rumored mitigation from other HN threads:

>Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini

It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day...

edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway.

edit2: https://old.reddit.com/r/PHP/comments/1xb2utu/upcoming_criti...

Someone claiming to be a releng for PHP says INI settings won't save you.

Upcoming Critical PHP Security Release (php.net)