I find it painful sometimes, sitting in a security conference where they talk about how insecure consumer devices and enterprise appliances are because of all the command-line RCEs on everything, and yet PHP is the insecure one? 🤦
Commit
1d5bff5
I don't know if it is still standing, but about two days ago, the fellow who had a bitcoin in a webserver running unpatched PHP still had not been hacked. No reports of hacks have happened. I genuinely wonder if php2shell was a moral panic. Not the bugs and potential problem (those were very real), but the spectre of a actual usable exploit in the wild.
commit 1d5bff5
I think it got pwned in 19 hours. There's a writeup about it. The exploit isn't easy to pull off, but now it's proven, it will be easier