Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #14438 > unrolled thread

[CM] Drupal vulnerability hits millions

Back to article view | Back to comp.lang.php

Contents

  [CM] Drupal vulnerability hits millions RS Wood  <rsw@therandymon.com> - 2014-10-31 21:04 +0000
    Re: [CM] Drupal vulnerability hits millions Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-31 19:32 -0400
    Re: [CM] Drupal vulnerability hits millions Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-11-01 08:11 +0100
      Re: [CM] Drupal vulnerability hits millions Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-01 09:33 -0400

#14438 — [CM] Drupal vulnerability hits millions

From the «the BBC is talking about Drupal?» department:
Title: Millions hit in Drupal hack attack
Author:
Date: Fri, 31 Oct 2014 07:30:59 -0400
Link: http://www.bbc.co.uk/news/technology-29846539#sa-ns_mchannel=rss&ns_source=PublicRSS20-sa

Software firm Drupal warns millions to "assume" they have been hacked if they
have not applied a patch for a recently discovered bug.

[toc] | [next] | [standalone]

#14439

On 10/31/2014 5:04 PM, RS Wood wrote:
> From the «the BBC is talking about Drupal?» department:
> Title: Millions hit in Drupal hack attack
> Author:
> Date: Fri, 31 Oct 2014 07:30:59 -0400
> Link: http://www.bbc.co.uk/news/technology-29846539#sa-ns_mchannel=rss&ns_source=PublicRSS20-sa
> 
> Software firm Drupal warns millions to "assume" they have been hacked if they
> have not applied a patch for a recently discovered bug.
> 

And this has exactly what to do with the PHP language?

Yes, I know Drupal is written in PHP.  But it has its own support
network.  T http://www.tvguide.com/Listings/roblem.his is not a PHP

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#14440

RS Wood wrote:

> <http://www.bbc.co.uk/news/technology-29846539#sa-> ns_mchannel=rss&ns_source=PublicRSS20-sa>

You can read in what that article refers to that Drupal had an SQL injection 
vulnerability (SA-CORE-2014-005) that was fixed.  SQL injection is not a 
problem limited to PHP.

<http://en.wikipedia.org/wiki/SQL_injection>

It would have been worth reporting here if a *PHP* vulnerability would have 
enabled the exploit, but so far it was only the negligence of Drupal 
developers that did.

If you want to *discuss* news, fine.  But no human gatewaying, please.

Please provide your full name in the From header field as it is customary 
here.

-- 
PointedEars
Zend Certified PHP Engineer
Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#14443

On 11/1/2014 3:11 AM, the pedantic troll Thomas 'Pointed Head' Lahn wrote:
> RS Wood wrote:
> 
>> <http://www.bbc.co.uk/news/technology-29846539#sa-> ns_mchannel=rss&ns_source=PublicRSS20-sa>
> 
> You can read in what that article refers to that Drupal had an SQL injection 
> vulnerability (SA-CORE-2014-005) that was fixed.  SQL injection is not a 
> problem limited to PHP.
> 
> <http://en.wikipedia.org/wiki/SQL_injection>
> 
> It would have been worth reporting here if a *PHP* vulnerability would have 
> enabled the exploit, but so far it was only the negligence of Drupal 
> developers that did.
> 
> If you want to *discuss* news, fine.  But no human gatewaying, please.
> 
> Please provide your full name in the From header field as it is customary 
> here.
> 

No, it is not "customary" to put ones full name in the header field in
this or any other newsgroup.  It is up to the user.

But I also know that's not according to Pointed Head's rules.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web