> Last week, PHP2Shell was being exploited before it was announced.
The PHP devs for some reason were also super anal about the embargo even once the details were entirely public (to the point of people sharing PoC videos on Twitter) and being exploited en masse. They had a patch ready, saw servers getting popped left and right, the internet collectively freaking out, and decided... nah, you can just shut your servers off for a bit.
Apparently, they weren't even making sure Linux distros had the patches ready for a quick release either. They were just sitting there while the world burned, saying the embargo was more important. Was the embargo more important, guys? Was it? As if PHP the language weren't bad enough, we got this fucking approach to security patches. Huge disdain for how that whole situation was handled.
2 comments
[ 0.16 ms ] story [ 7.0 ms ] threadThe PHP devs for some reason were also super anal about the embargo even once the details were entirely public (to the point of people sharing PoC videos on Twitter) and being exploited en masse. They had a patch ready, saw servers getting popped left and right, the internet collectively freaking out, and decided... nah, you can just shut your servers off for a bit.
Apparently, they weren't even making sure Linux distros had the patches ready for a quick release either. They were just sitting there while the world burned, saying the embargo was more important. Was the embargo more important, guys? Was it? As if PHP the language weren't bad enough, we got this fucking approach to security patches. Huge disdain for how that whole situation was handled.