If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch :
if ($http_content_type ~* "multipart") {
return 403;
}
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases :
session.upload_progress.enabled = Off
It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.
This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.
But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch :
if ($http_content_type ~* "multipart") {
return 403;
}
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases :
session.upload_progress.enabled = Off
Have you tested this against a POC to see if it actually mitigates? Seeing a lot of proposed mitigations but with very little detail about whether they worked or not.
It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.
This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.
But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.
I have tried the so-called-POC of the URL you linked, it seems it is not a full POC. I have tested it against my local PHP instances; it does not work.
Yes! The models can choose their speeds and command durations. Fable for example took so long to pause and think between giving steering commands. Astra took less time but still the latency is so high that they have to pretty much drive slowly step-by-step. And definitely any human could do this way way faster, but inference speeds, latency, and intelligence get better fast enough that maybe in a year from now the models will be even more competent at this (but still probably worse than specialized models for driving).
Agree as well he has lost his mind in the battle and does not appear to be trustable in such a competitive market at current state of things (well .. ai).
Probably a good move to move on with someone else that doesn't need to get microdosis at burning man yearly to get ideas.
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
reply