There isn't an easy exploit for this PHP vulnerability

Re:There isn't an easy exploit for this PHP vulnerability by hypfer on Thursday October 22, 2026 @02:38AM (#50191978)

If core developers say "this is actually bad", don't bargain if a patch is needed. Patch it.

There is no higher authority on "this is actually fucked" other than the people that actually make that very sausage.

Patching it is painful. It needs to be done regardless.

[ Parent | on HN ]

Re:There isn't an easy exploit for this PHP vulnerability by silentbob7 on Thursday October 22, 2026 @02:43AM (#50192008)

Yes, we should all patch like every other bug - but its the CVSS score and the panic which is in question.

[ Parent | on HN ]

Re:There isn't an easy exploit for this PHP vulnerability by hdgvhicv on Thursday October 22, 2026 @03:42AM (#50192403)

I think I’ve identified every device on my internal networking running php, but I’d love a reliable poc I could poc that I could run before someone starts lateral movements.

If it’s easy to exploit then it should be easy to find a POC

[ Parent | on HN ]

Re:There isn't an easy exploit for this PHP vulnerability by ferngodfather on Thursday October 22, 2026 @03:02AM (#50192117)

CVSS scores are a bad measure anyway

[ Parent | on HN ]