Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming

There comes at point at which it is better for everyone to just disclose the details and pursue Full Disclosure. I think we reached that point hours ago. It has been incredibly frustrating watching Twitter and that (potentially, I don't know how reliable the leaks are) being a better information source than anything else, at least so that those of us hosting stuff ourselves can try and explore if there are any defensive measures that can be put in place in lieu of any actual fixed builds being released. I suspect this is already being actively exploited now. https://x.com/J4ck3LSyN/status/2112703096443097263 They've now posted a proof of concept as well.

@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late. CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly. Speculation is that the affected subsystem runs before any application code and affects all default installs.

Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.

Tweet allegedly showing exploit at work: https://x.com/k_firsov/status/2112641845926989944 (video). Yikes

Rumored mitigation from other HN threads: >Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day... edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway. edit2: https://old.reddit.com/r/PHP/comments/1xb2utu/upcoming_criti... Someone claiming to be a releng for PHP says INI settings won't save you.