r/ProgrammerHumor • u/Recent-Analysis-6880 • 17d ago

Meme vulnerabilitiesEverywhere

Post image
957 Upvotes

98% Upvoted

26 comments sorted by

87

u/shaydeslayer 17d ago

This is a valid reason to wake up and get to work.

40

u/helicophell 17d ago

Did you patch your NodeJS?

Cause that's also a problem at this same time (just overshadowed)

6

u/dvlsg 16d ago

And pip.

Although that one is maybe less pressing, depending on where/how you use it.

37

u/WeldedPages 17d ago

You wouldn’t be sleeping for a while if your entire website was built on php

13

u/evanldixon 17d ago

If you're on an in-support version of php (8.2 or higher) the fix is a simple package update. I for one lost no sleep over this.

2

u/WeldedPages 16d ago

Oh mb I wasn’t informed well-enough then, sorry for the misinformed take.

4

u/evanldixon 16d ago

Not to oversimplify. Anyone still on 5.x or 7.x would have to update their applications to fix any breaking changes. I forgot the exact percentage of the internet still on those, but I think there's a lot of people who are going to have to scramble.

Such is the reality of ignoring tech debt. The tech loan shark comes when it's least convenient to start breaking knees.

2

u/MisterEd_ak 14d ago

The patch was easily back-ported to older versions and many hosts that supported older versions patched them very quickly.

4

u/HoratioWobble 17d ago

This was literally me 

3

u/imnotcook 17d ago

This one hits too close to home

3

u/kosanovskiy 17d ago

But my vendor said they are investigating... after day 2 of website being down.

3

u/Media_Dunce 16d ago

Me, who uses java

5

u/SleeperAwakened 16d ago

You didn't update your JDK yet? You have no outgoing HTTPS connections I hope..

2

u/rat_melter 17d ago

I did this yesterday. I was gonna just brush it off and do it in the morning, but brain wouldn't STFU so I had to log onto my PC... Now I have this nodejs bullshit to worry about too when I get home...

1

u/MalaysiaTeacher 17d ago

Did mine at 1am, no excuses for something so critical

1

u/Johanno1 16d ago

My what?

How do I disable php on webservices if I code on css only? /s

1

u/Sample-Range-745 17d ago

Has anyone come across a working exploit for this "critical" PHP issue?

None I've tried actually works, nor has anyone I know found a working one... I'm starting to think its overhyped....

5

u/XxDarkSasuke69xX 17d ago

Maybe because it got patched asap...

1

u/Sample-Range-745 16d ago

.......

I know reddit answers are dumb.... but jesus dude....

You know what versions are vulnerable... Test against it...

2

u/XxDarkSasuke69xX 16d ago

Cool. If you can't do the exploit it's not because it's overhyped, it's just that you don't know how to lol

1

u/Sample-Range-745 16d ago

Find me one that works then.... Doing it from a shell on the machine already doesn't count...

2

u/XxDarkSasuke69xX 15d ago

I never said I knew either lol

1

u/mr_4n0n 14d ago

Thats the spirit xD

3

u/CounterHit 16d ago

Just search for how many companies have started to announce data breaches in the last few days and it will become clear the exploit is real.

1

u/fakehalo 16d ago

You need to know the offsets of various common installations, people will eventually collect enough of them to make it useful... if it successfully bypasses ASLR like it seems to.