Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers

Why does a world-class firewall stack need PHP? I'm sure PAN-OS has some neat DPI features, but I would love to see firewalls that are implemented in FPGA, where the tasking was compiled down to gates to be performed deterministically, much like the low port count network switches we have today.

Well it's more like Rudy Giuliani starting a bitcoin company regardless of his expertise in any one particular area right, which basically has happened a couple times now: https://www.ai-cio.com/news/former-associates-rudy-giuliani-...

He has already IT experience then. Surely he learned something out of it. Securely using apps. Discretely handling deals, etc.

Anyway from their webpage: > We work directly with heads of state, ministries, national cyber authorities, and the senior officials responsible for executing national strategy.

So I presume he has and provides contacts. Just the usual one hand washes the other. Nothing nefarious I'm sure.

[flagged]

"There was also that other guy who posted "steal my bitcoin" on a vulnerable PHP server with the private keys to prove it was overblown, and got his bitcoin stolen within a day."

19 hours: https://stealmybitcoin.com/

Part of the confusion is that the initial PR for the release made it sound like there was a ready-to-go exploit that was just push button, get shell on any PHP server in the world. That turned out not to be the case, as evidenced by the fact that the number was 19 hours and not 19 minutes.

But the fact that it was 19 hours and not "never" also does provide a data point that everything that was vulnerable really was vulnerable, it just may not have been quite as vulnerable as it was initially presented. Still plenty vulnerable, of course.

My point here being that the initial 24 hours were very confusing and I think it's worth remembering that and giving people grace for it. Even now, I've heard rumors of an exploit that does work on all boxes without making changes for a specific target but I'm not actually sure whether that exists or not. (Any further info welcome.)

> I'm not sure how "RCE on every PHP server, from anywhere on the internet, no other requirements" could possibly be underblown by anyone

It could be overblown if it's not true. The amount of time it took for anyone to claim the Bitcoin from the supposedly-vulnerable PHP site convinced a lot of people that the vulnerability was not as bad as claimed.

> I am very curious to hear why you thought it was overblown.

Not having made the claim (took down my website too), but because PHP is not connected directly to the network. While you cannot prevent PHP from being overtaken from inside the PHP program, you can prevent PHP being executed on malicious data by configuring the webserver. It's overblown in the sense that it would be even more serious if the same happened in the webserver itself.

I think it goes back to the huge amount of anti-AI sentiment that's out there today. Any AI accomplishment gets undersold by haters, i.e. people maintaining that the Navier-Stokes solution was stolen, people saying that Lean proofs can't be relied on, exploits like PHP2Shell are esoteric and not usable in the real-world, etc. Those are just comments I recall reading off the top of my head but I could find sources if anyone wants. I think it's just a way for people to cope and fool themselves into thinking that this whole AI thing isn't a big deal and will just blow over.

Its overblown in the sense that 70% of the internet was not in fact vulnerable, as widely reported. And not everyone is a hackor because they have access to llms. Go look at normie coverage from people like Linus tech tips and you'll see them saying how millions of servers were under attack by script kiddies with llms, amd how llms are so dangerous.

The whole thing was basically a psyop, whether intential or not idk but Califs research was funded in part by OpenAI so there's that.

I bet it's fortinet.

With all that said, how exploit chaining is working these days I think most peoples considerations are not weighted toward bad enough.

True-ish? If your firewall's admin page is internet-accessible, you have no excuse for not doing "bolted to bedrock" lockdowns of your web server config and your PHP config. Either of which could have blocked exploitation of the PHP vuln.

   ;;;;;;;;;;;
   ; WARNING ;
   ;;;;;;;;;;;
   ; This is the default settings file for new PHP installations.
   ; By default, PHP installs itself with a configuration suitable for
   ; development purposes, and *NOT* for production purposes.
   ; For several security-oriented considerations that should be taken
   ; before going online with your site, please consult php.ini-recommended
   ; and http://php.net/manual/en/security.php.