Re: PHP2Shell

From	The Natural Philosopher <tnp@invalid.invalid>
Newsgroups	comp.os.linux.misc
Subject	Re: PHP2Shell
Date	2026-10-22 19:50 +0100
Organization	A little, after lunch
Message-ID	<11bdlt7$13lnp$6@dont-email.me> (permalink)
References	<11bdjto$13lnp$1@dont-email.me> <njv2tnFjpo3U1@mid.individual.net> <11bdl2u$13lnp$4@dont-email.me> <njv3ugFjuhmU1@mid.individual.net>

Show all headers | View raw

On 22/10/2026 19:45, Andy Burns wrote:
> The Natural Philosopher wrote:
> 
>> That sounds like it is only relevant to large uploads: If the code 
>> doesn't permit that you should be safe?
> 
> I did hear that causing the exploit depended on uploads, but wasn't sure 
> enough that no uploads made it safe, so did recommend one customer to 
> shut their customer portal down.
> 
> The code is written/hosted by a 3rd party, I just point the DNS at it.
Ah.

Yes. I've blown PHP up with large uploads. And downloads. So I wrote the 
handler for those in C.

I don't think any of my sites allow user upload beyond half a dozen 
parameters.

Well that's a starting point: No doubt other stuff will emerge in due course

-- 
Ideas are more powerful than guns. We would not let our enemies have 
guns, why should we let them have ideas?

Josef Stalin

Thread

PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:16 +0100
  Re: PHP2Shell Andy Burns <usenet@andyburns.uk> - 2026-10-22 19:28 +0100
    Re: PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:36 +0100
      Re: PHP2Shell Andy Burns <usenet@andyburns.uk> - 2026-10-22 19:45 +0100
        Re: PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:50 +0100
        Re: PHP2Shell doctor@doctor.nl2k.ab.ca (The Doctor) - 2026-10-23 01:59 +0000
  Re: PHP2Shell Richard Kettlewell <invalid@invalid.invalid> - 2026-10-22 19:58 +0100
    Re: PHP2Shell Nuno Silva <nunojsilva@invalid.invalid> - 2026-10-23 00:39 +0100

csiph-web