John David Pressman on Nostr: BTW knowledge of the existence of this vulnerability enables a well financed malware ...

BTW knowledge of the existence of this vulnerability enables a well financed malware group to use AI to find it, if you run PHP anything you should be taking the service down NOW until a patch is available. And then patch before bringing the service back up.

RE: https://bsky.app/profile/did:plc:3dq7pt3ueeedfxrpnpmeycvz/post/3myducbbryc2f

quoting
note1vp3…a58w

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest

yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

RE: https://bsky.app/profile/did:plc:3dq7pt3ueeedfxrpnpmeycvz/post/3mydptd5yjk2f
note1kj4…t906