I’ve heard people saying the CVE still hasn’t been resolved. Is that true?
Commit
1c940b3
im afraid yes
Is there a source for this yet?
I've seen some tweets on Claude reviewing it as still possible, and some of people "exploiting" it still, no solid evidence but I would not relax yet
This is what I've seen so far:
https://x.com/MrNiceTry/status/2113015805852147996?s=20
X (formerly Twitter)Mr. Nice Try (@MrNiceTry) on Xseeing "the PHP fix was bypassed!" posts? this is a decade-old trick and it only works on sites with an unusual setup. most sites won't be affected. still install today's PHP update, then relax.
commit 1c940b3