It's things like "under the attacker's feet" which completely throw me off. While trying to parse the text, my brain tries to imagine a surprised hacker.
Yeah but this AI music is worse than any AI produced code. They're both awful but I really lose all respect for people who think these Sumo songs sound good. Wow I hate that AI musician voice so much.
I just wrote almost the same thing (I start to write my
comments before I read what others say, so that it is not
influenced directly what I write). I am glad to come to the
same conclusion - this website is both visually interesting
as well as very annoying.
I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.
You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.
I can literally feel my eyes physically defocusing trying to read this, and I can’t help but conclude that, at a level below conscious thought, my brain is trying to defend itself from AI-generated text. Perhaps it is more of a cognitopoison than I explicitly knew.
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch :
if ($http_content_type ~* "multipart") {
return 403;
}
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases :
session.upload_progress.enabled = Off
How is this a better source, the current post is a PoC? This is just a warning...
You're not even reading the things you're saying are worse, and reccomending things that arent what you say they are (because you didnt read those either)
Announcing this thing and then putting an embargo on the fix for 24 hours is by far the most irresponsible thing internals has ever done and I have seen them do some insane shit in the past 20 years.
It is visually interesting but also annoying. I hate to
admit it, but as I grow older, I may get dumber and I
much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages
have not yet all fixed existing bugs. Has not AI been used
to find bugs or assumed bugs? Why are bugs found in old
code still?
Why would they hand code a website for an exploit that they probably found 15 minutes before and will be fixed in a few hours? The copy should have been better though.
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
You're not even reading the things you're saying are worse, and reccomending things that arent what you say they are (because you didnt read those either)
<If "req('Content-Type') =~ /multipart/i"> Require all denied </If>
How fast will the repos be updated?
It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?
>Leave Nothing
Cringe larping skiddie nonsense