@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.
CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.
Speculation is that the affected subsystem runs before any application code and affects all default installs.
Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off
Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.
@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.
CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.
Speculation is that the affected subsystem runs before any application code and affects all default installs.
Well this is about as bad as it gets, so I guess the internet will get a bit of test and old forums will turn into a botnet
Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off
I have heard Kirill Firsov say that, but does anyone even know the vulnerabilities? Could be a meme.
Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.
It was leaked
Where?
Here
https://news.ycombinator.com/item?id=50167754
I don't see any details of the vulnerability leaked except "code execution"...?
It got flagged already, can't see it.
Whew! Imagine if the details were documented in the clear on HN for anyone to see.
[dead]