RE: https://infosec.exchange/@bontchev/117494771692069001
"[23.10] At this time, CrowdStrike Counter Adversary Operations has not observed successful exploitation of these vulnerabilities in the wild or within our honeypot environments. Additionally, we have not identified any fully weaponized exploit, or any POC exploit, sufficient to widely achieve applicable exploitation. "
"Assessment
Exploit developers are unlikely to create a single universal exploit that works reliably across all affected PHP deployments. The creation of a POC exploit capable of reliable remote exploitation is feasible, however, against specific deployment profiles, such as a fixed Docker image or a known combination of PHP, libc, SAPI, and web application versions."
"Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation": https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/
Infosec ExchangeVessOnSecurity (@[email protected])"Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation": https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/