Ask HN: Can a PHP RCE vulnerability auto-patch vulnerable servers?

Sorry if its a stupid question, but...

If a PHP vulnerability allows remote code execution, could it be used to automatically patch the vulnerable servers before attackers exploit it?

In theory, could a proof of concept detect vulnerable installations, apply the appropriate security fix, and verify that the patch was successful?

What technical or practical obstacles would prevent this from working safely at scale?

2 comments

[ 1.1 ms ] story [ 5.3 ms ] thread

Not if the security vulnerability does not also lead to root privileges.

d3Xt3r 6d ago ↗

Not necessarily, you can run php without root, and if you grant it CAP_NET_BIND_SERVICE capability, you can even run it on port 80.

There's many other ways to go about it too without granting that capability (like port redirection, reverse proxy tunnel etc).

In fact I would say these days, no one should be running php or any web stack as root unless you've got very good reasons to do so.