r/technology • u/Radio_TVGuy • 12h ago

Security New PHP vulnerability means the Internet will have a very rough couple of days

https://appleinsider.com/articles/26/10/21/new-php-vulnerability-means-the-internet-will-have-a-very-rough-couple-of-days
2.7k Upvotes

98% Upvoted

287 comments sorted by

View all comments

Show parent comments

37

u/ILOVECOCKSTARGAMES 9h ago

If someone hosts a site how do they get their info compromised from this? And will there be data leaks on other sites members?

95

u/tommyk1210 8h ago

This is basically an exploit that allows an attacker to perform remote code execution (RCE). That is one of the worst exploits you can have.

An attacker, under certain circumstances they can induce, can basically get a full “shell” (terminal/command prompt equivalent) on the target server.

This means they can, for example, tell the server to send all credentials on disk to a remote server, or find the database password somewhere on config/disk and login to the database, then dump the whole thing to some remote server.

It’s bad.

20

u/MrTastix 7h ago

Yeah, I am a member of forums which haven't been active in years but are still around for prosperity reasons.

There's no good way to contact the hosts of these people to let them know, that's how inactive it is. The admins likely already know about this given their professions but they have to still remember all the projects they worked on 15 years ago with PHP to go back and fix it.

23

u/tommyk1210 7h ago

Nah, plenty of these admins were teens setting up web forums in the 2000’s, that was me too. Some, like me, will have made a career of it but just as many are happy to pay the modest hosting fees and have zero real idea what they’re doing.