<- Back
Comments (84)
- athrowaway3z> A1 — Memory Exhaustion (~383MB):I'm actually somewhat surprised at the clumsiness here.I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it.DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - https://github.com/KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests.Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.
- colemannugentReading this I'm almost certain the firewall vendor is Palo Alto Networks. They included a PAN-OS setting verbatim and the SELinux config matches my experience.
- xxmarkuskiDream is btw founded and led by Sebastian Kurz, who was head of the Austrian government. He had to step down because of a corruption scandal.
- tensegristperhaps i was wronghttps://news.ycombinator.com/item?id=50272530
- loeg> For security purposes, we are not disclosing the vendor or the affected versionsWat
- codegeekI am confused. Is this attack possible even after the PHP patches OR these servers just didn't patch ?
- bix6It sounds like multiple things were misconfigured on these servers and they still have access?!?
- j45Wild, I hope the challenge on HN didn't contribute to this.
- tamimioFirewalls are likely fortinet
- npn> Claude Code had been installedI just do not understand. CC is not the sole harness in the world, why the attackers insist to use it.
- brcmthrowawayWith software being fundamentally unsafe I see everything hardwired in chips.FPGA stocks? DV is about to become hot again..
- paxyNow let’s watch the goalposts shift in real time about how severe this vulnerability is.
- jvandijkHaha woopsie
- lunargamma676Same here, though what stuck with me is that a firewall's admin PHP page was reachable from the internet at all, keep that on a mgmt VLAN.