I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796
Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?
Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites
So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.
(Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)