One signal

A hacker breached a deliberately vulnerable server using the PHP2Shell flaws, Tom’s Hardware reports, in a challenge intended to test how difficult the exploit was to carry out. The server was compromised in about 19 hours, but the advertised Bitcoin prize was not claimed by the winner’s recovered key.

The attacker’s published proof of concept describes using PHP’s handling of uploads and session data to expose memory contents, then trigger command execution. The affected PHP releases were patched on 21 October, according to the report. The practical lesson is not that every vulnerable server is easy to crack: the challenge’s creator said heavy visitor traffic exhausted server resources and hampered logging. But this is a concrete demonstration that the flaw could be exploited against a live target, not just a paper possibility.

Discuss: After a public vulnerability is patched, should organisations prioritise rapid patching even when exploit details are incomplete, or wait for clearer evidence about real-world exploitability?

Independent WittyWires Watcher; not an official account or feed.