minitech
Every duplicate closure comes with a link to the other question.
> leaving my karma negative. So basically, can't do anything.
Your reputation on SO can’t go below the initial value of 1.
I suspect the rest of your anecdote has about the same level of competence/accuracy.
Sure you can. (But it is a significant problem that they start at the bottom of the score-based answer sort and don’t get attention.)
- but anyone who deploys thousands of lines of vibe-coded C that implements a transforming HTTP proxy from scratch instead of a patch (hey, it “might even be safer than the patch”!) deserves what they get
edit: shocker https://news.ycombinator.com/item?id=50199456
I don’t suppose you’re thinking of when the issue was discovered? That was August 1st, according to https://calif.io/php2shell/#the-discovery.
> Or is that always formatted by the next process' vm?
So yes, that’s sort of how it is.
This isn’t a thing; virtual memory (https://en.wikipedia.org/wiki/Virtual_memory) is very old, and Linux has never not used it. It takes a separate vulnerability (a “local privilege escalation”) to do what you’re getting at. (However, those are plentiful, and arbitrary malicious code with PHP process privileges is often already catastrophic for a web service.)
That said,
> OP seems to be implying that there's no way the UAF bug could be used to run arbitrary code with higher privileges than PHP itself
No, nowhere does the article imply that at all.
Yeah it does. Part of it is being a popular starter language before people know what they’re doing, but a lot of it is legitimately terrible language[1] and API design, especially in older versions. It also has CVE-2026-109618, a type of vulnerability many languages aren’t even capable of having (since it wouldn’t be part of the language, and the library that implemented the equivalent would only be present when necessary and usually not written in C - with some exceptions).
[1] People have already covered this in depth, but here’s a lesser-mentioned taste: https://web.archive.org/web/20261017012819/https://www.php.n... (one section, btw)
And again, npm is also an example of “a singular supply chain [selected] by the author” in this way. On top of what cpuguy83 mentioned, curl | sh is vulnerable to compromise anywhere on the stack serving the script (domain name, host, maybe CDN, GitHub account if it’s just a redirect to GitHub as they regularly are), and coming back to what I originally said, even the real author might decide to serve you a special version of the script that nobody else is getting. You’d never know.
(I picked this option for ease of comparison, getting a couple of major security wins with very low effort; I don’t recommend `npx`ing stuff in an otherwise unprotected environment either.)
* well, you can be somewhat more sure
cat >> ~/.bashrc <<'EOF'
sudo() {
sudo install-drivers-without-your-permission
command sudo "$@"
}
EOF
* the 7-bit quantization + 1-bit noise option not by much, but still, visible
Ooh, the rare* double straw man. Since you look like you could use the exercise in intellectual honesty, I’ll pose the question directly: can you think of any reason that the ability for anyone to generate fake photographs indistinguishable from reality with no skill, time, or money required might make the world a worse place? Cause harm?
* I wish
- not even a position
- not something you were remotely “prescient” about
Actual sense in which it’s first:
> Happily, modern instruction sets (Arm SVE, RISC-V V, x86 AVX-512) include a special instruction suitable for partitioning. Given a separate input of yes/no values (whether an element is less than the pivot), this "compress-store" instruction stores to consecutive memory only the elements whose corresponding input is "yes". We can then logically negate the yes/no values and apply the instruction again to write the elements to the other partition. This strategy has been used in an AVX-512-specific Quicksort. But what about other instruction sets such as AVX2 that don't have compress-store? Previous work has shown how to emulate this instruction using permute instructions.
> We build on these techniques to achieve the first vectorized Quicksort that is portable to six instruction sets across three architectures, and in fact outperforms prior architecture-specific sorts.
The “Usage” section doesn’t involve installing any dependencies, for example: https://github.com/GraafHenk/numberwang#usage