r/technology • u/Radio_TVGuy • 12h ago

Security New PHP vulnerability means the Internet will have a very rough couple of days

https://appleinsider.com/articles/26/10/21/new-php-vulnerability-means-the-internet-will-have-a-very-rough-couple-of-days
2.7k Upvotes

98% Upvoted

287 comments sorted by

View all comments

989

u/Single-Virus4935 12h ago

This will be way worse than log4shell, which is still a problem, as sooooooo many php servers are plain unmaintained and also php is used on maaany wrbinterfaces for devices like.routers, firewalls, IoT etc. which will never see an update ever. Log4shell was more enterprise and not that ubiquitous like php.

179

u/CalebKrawdad 11h ago

That was a terrible Christmas on-call though.

46

u/Single-Virus4935 11h ago

Yep, I am soooo glad that I don't have any public facing php or java anymore.

Just go and rust with tight validation on http requests.

There was a German CCC talk or so where some vanish guy described how a WAF is dine correctly and I just only allow stuff I know I need and is safe.

Setup is also quite unique with gvisor as isolation etc. and people called me paranoid and hurting business.

Now, I have three employees working on projects while my former employer with 100 empl  I worked for as a CTO which CEO blocked any security in favor of velocity is completely offline right now, on a unmaintained php/laravel/WordPress/legacy php code with no clear upgrade path to the patched php versions.

All engineering is now dedicated to this now. 

I raised this issues for 6y but got no resources and eventually left. Was rough but I am so glad I don't have to deal with that anymore

3

u/tweelix 11h ago

Do you have a link to that talk?

9

u/Single-Virus4935 11h ago edited 10h ago

https://youtu.be/BOGUwO2kPLo

Edit: I don't remember if it was in this talk but force HTTP/2 between ReverseProxy and App because HTTP/1 is vulnerable to certain attacks where you can smuggle requests through the Reverseproxy because of parser differences which isn't a problem for the binary framed http/2 and 3