This is how I've been feeling since Tuesday:
XFEDI
ActivityPubRemote profile
Alesandro Ortiz 🇵🇷🏳️🌈
Software Engineer. Security Researcher. Puerto Rican 🇵🇷. New Yorker. Bilingual. LG(B)TQ 🏳️🌈. He/him.
Focused on browser research. Glad to collaborate.
Website: https://AlesandroOrtiz.com
(Header 📷: roriv3ra on IG)
Posts
Railway (hosting platform) also got popped, customer secrets stolen.
https://blog.railway.com/p/security-disclosure-wednesday-october-21st
https://status.railway.com/incident/QH8L8B3E
Status page shows they took hours before disclosing it was a security incident.
Railway BlogSecurity Disclosure: Wednesday October 21st | Railway BlogRailway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention
Writeups from the various researchers who discovered the vulnerabilities:
Wiz: https://www.wiz.io/blog/php2shell-php-rce
Calif: https://calif.io/php2shell/
OpenAI: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
wiz.ioPHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz BlogCore PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
WSJ article with some details about the discovery of the PHP security vulnerability: https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?st=tBLRBh&reflink=desktopwebshare_permalink (paywall)
#PHP security advisories with technical details:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
HetrixTools, the service I use for uptime monitoring, is down (presumably due to the PHP vulnerability). Didn't have that in my bingo card today. 🙃