Asked how the PHP2Shell vulnerabilities were discovered, given that humans spotted something first and AI later worked out how to exploit it, Steve summarizes the PHP Foundation's CVE timeline: a 2024 audit flagged a likely bug but nobody could build a working exploit.
I heard about it through just the news sources that I hear things through.
Can you talk to me a little bit? About how this was discovered because I understand there's somewhat of an interesting backstory by way of the humans figured it out and then the robots told us how to do it.
So I did just a small bit of poking around about this because I was kind of curious. So part of this is my interpretation of the summary covery because there's been a lot of meta-analysis out there around this. But when I was curious about this, one of the things that popped up was the PHP Foundation has had a timeline for the CVE. And inside there, if you go looking, they talk about how in 2024 there was an externally funded audit. And during that time, a PHP core developer actually found what they thought were signs of out-of-memory handling problems. And they theorized that an exploit could happen through this code path, but they were unable to create what's called an RCE. So they were not able to find a path for exploitation themselves. And as it was, as their time was winding down, there was not a clear way that an exploit could happen about that. And so they moved on. And so again, in 2024, there were some signs that maybe there was some problems here. But again, nothing concrete was found. Like we couldn't, they couldn't find a reproducer. So they suspected that they had run into a problem, but were not able to actually reproduce it because they didn't have the theory didn't find an actual code path. So it became, it was one of those things that it was trying to find a needle in a haystack, as they say. So I just thought that was kind of interesting that the humans had identified a potential problem a couple of years ago and were…
it. I thought it was pretty good that we got like a lot of the fix, like everything had updates of it. I shouldn't say everything, but the vast majority of places were on top of this. You know, we've got this down to a fine science. So the fixes were available. All of the major distros had…
Yeah, I had a box that I hopped on and I ran the updates and didn't see PHP. It was like, well, that's kind of weird. I would have thought that this should have had a patch. And it turns out that I had unintended upgrades, unattended upgrades on. And I don't remember setting that. So that must have…
I love it. All right. Hey, the music in our ears. It means we're out of time. I thank you for joining us. We record the show live every Tuesday at 6 p.m. Central at AskNowashow.com. There you'll find all of the articles and references we use to make the show. You can go all the way back to episode…