There was a discussion at our work (which was affected) that the vulnerability had been leaked early, hence pulling the plug on everything as normally these are announced at the same time as the code patch.

Show Post

Here's the post from the researchers who uncovered the vulnerability (who are security researchers doing their job, and who have disclosed this mess about as well as you can do – they're not the bad guys here).

Show Post

So…given how high risk this vulnerability is, and how many possible attack vectors (routes in for an attacker) there are, some places are doing the equivalent of yanking out the power cord until the dust settles. That could prove to be a very good idea, tbh. It's gonna be an interesting few days.

Show Post

The moment a vulnerability like this is announced, a race starts between people looking to exploit it, and those needing to secure their systems. This one is a particular nightmare as lots of background and largely forgotten bits of infrastructure use it. Expect to see lots of hack-and-leaks soon.

Show Post

Researchers (with help from AI) discovered a major vulnerability in PHP, a scripting language used to power around 70% of websites. If exploited, it allowed an attacker to get full access. Thankfully, they waited for a patch before disclosing it. But…that patch needs applying and testing.

Show Post