I find it painful sometimes, sitting in a security conference where they talk about how insecure consumer devices and enterprise appliances are because of all the command-line RCEs on everything, and yet PHP is the insecure one? 🤦
Commit
775582e
I don't know if it is still standing, but about two days ago, the fellow who had a bitcoin in a webserver running unpatched PHP still had not been hacked. No reports of hacks have happened. I genuinely wonder if php2shell was a moral panic. Not the bugs and potential problem…
I think it got pwned in 19 hours. There's a writeup about it. The exploit isn't easy to pull off, but now it's proven, it will be easier
commit 775582e