I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796
Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?
Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites
yeah the uploadprogress and multipart are caused by php loading the request into memory and that going over the limit. thats the most straightforward and dangerous and one of the mitigations was limiting uplaod sizes. But they triggered it first using Wordpress to trigger the oom. And it sounds like there are ways to cause the form processing to bail without and oom and trigger a similar pointer reuse.
So the post/upload oom are maybe the most interesting but you can bet if people dont patch we’ll see more involved versions. and since php is hidden in things like routers and server management devices and… thats probably a safe bet.