“Drupalgeddon2” touches off arms race to mass-exploit powerful web servers

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by fabian2k on Sunday April 22, 2018 @04:31AM (#16895277)

The original Drupalgeddon vulnerability was seriously problematic in the speed of exploitation. The automated exploits were developed only hours after the announcement, and ~7h later as far as I remembered widespread enough to consider all unpatched installations compromised.

This exploit was far more lenient in timing, there was an advance notice of a serious vulnerability, and the automated exploits were weeks later this time.

There are certainly many people running a CMS themselves that don't have the capabilities to keep them reasonably secure. But it's not that hard if you have a reasonably small attack surface, e.g. few plugins and no user-generated content/accounts. And of course you need to subscribe to the relevant security mailing list.

[ Parent | on HN ]

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by Roritharr on Sunday April 22, 2018 @05:00AM (#16895339)

Sure I could run a CMS reasonably secure Drupal Site. But I'm at a successful startup, have had years of experience hardening Websites and know my it-sec hygiene. This also makes me not the target audience for CMSes like Drupal. Most of us agree that having static site generators are a much better solution for most use-cases. The people needing WordPress and Drupal don't know what Usecases they need, they are exploring the possibilities often times.

[ Parent | on HN ]