PHP Vulnerability Disclosure Triggers Mass Website Shutdowns Before Patches
· 7:27 · Watch on YouTube ↗
Summary
ThreatWire describes two PHP vulnerabilities with potential remote code execution, an early release of fixed images that disrupted coordinated disclosure, and an estimated 43 million affected services before patches.
Key points
- The video reports that two PHP vulnerabilities could cause memory corruption and potentially allow remote code execution; it does not provide their CVE identifiers.
- Chainguard published fixed images about six hours before the coordinated disclosure, according to the video, allowing attackers to study the fixes while other PHP users awaited patches.
- Websites and services, including Pokémon services and the Netherlands’ National Cybersecurity Center site, reportedly went offline or entered read-only or maintenance modes before patches were released.
- Sensus estimated that nearly 43 million services were affected on October 21; about 10 million had been patched as of the recording.
- The PHP Foundation moved the planned patch release forward by 24 hours, from October 22 to October 21.
- The video says fake proof-of-concept exploits circulated before a researcher mistakenly published a video demonstrating working attacks against PHP-based services.
Article Details
- Topics
- [00:27] The initial claims about two critical PHP vulnerabilities and the circulation of fake proof-of-concept exploits.
- [01:30] The patch embargo, accelerated release schedule, and accidental publication of a working proof-of-concept video.
- [02:18] Chainguard’s early publication of fixed images and the dispute over coordinated disclosure.
- [03:26] Reported service outages and read-only modes before patches were released.
- [04:21] Sensus estimates of affected and patched internet services.
- [04:47] How stale pointers after freed memory can lead to corruption and potentially remote code execution.
- [05:13] Researchers’ discovery and reporting timelines and the dispute over credit.