Silas Cutler (p1nk)
@silascutler
- The only winning move is not to play. Come back next weekWe are aware of the PHP vulnerability and are shutting down for the weekend.
- We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619 We cannot share further information right now. Take this seriously and apply patches when available.
- Rough estimate - likely over 1.3 million internet exposed hosts vulnerable to #PHP2Shell
- Assume exploitation already underway. PHP still underpins many key open-source and close source applications #WordPress #Drupal #MediaWikiWe were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619 We cannot share further information right now. Take this seriously and apply patches when available.
