So anyway... nobody seems to have been confirmed pwned so far. Seems to have been a mostly theoretical threat? 😬
Commit
92c4554
As far as I understand it it needs to be pretty well-chained... like you need to have access to file system reads already, which seems like a pretty bad server config flaw to begin with.
Dislaimer: I might just be talking out my ass though! This is based on an article I read…