I guess nearly everybody has installed the patch by now

I admire your belief ;)

https://php2shell.censys.com/

ATM almost 80% of scanned services are still vulnerable. Considering that **About 54% of PHP services hide their version** and are not counted as affected or patched.it doesn't look too good

That is my understanding too. But then when I was reading the article, there was a line somewhere that in order for the exploit to be successful, the server needs to be using eval

I used to think so too but then there was a study that any kind of stress (heating, mechanical, cooling) makes any kind of plastic release microplastics into the food. With heating being the worst, cooling "the best"

Of course I can't find it now, I guess it might have been after the pandemic (meaning - two eternities for the way my memory works, there's no chance I can remember what were the noticeable words in the title). But here's something similar https://pubs.acs.org/esthag/article-abstract/57/26/9782/316425/Assessing-the-Release-of-Microplastics-and

AFAIU this is not about the size of the file but making the php process that runs a file surpass the configured limit (of RAM). At which point sometimes something goes wrong with letting go of that memory and then the second vulnerability allows using that limboed memory that not only shouldn't be used but also can contain some internal values from the first one

This onboarding has been in Piefed for quite some time now. But since you joined a week ago, it's weird you're getting it now. It should have been on your first log in

AFAIK the decision to show this is a flag in the DB. So it won't matter if you have subscribed something earlier. But how it got toggled back? Gremlins?

Lemmy and history, no. On Lemmy you can see comments from Mastodon and posts (toot with a Lemmy community pinged inside. Which is rarely done but happens). But not the toots themselves
Piefed now allows to directly follow accounts (similar to Mastodon, Friendica, etc) and you can start getting the new toots after following an account https://piefed.zip/c/microblogs

What's up with the culture on Nostr?

@[email protected] I think i_am_not_a_robot has a point that it's too soon

For unrelated reason I had to wipe my blocklists on VPS for a moment. Just during a few minutes one of my containers was getting hammered with all kind of .php requests.
Even if it wasn't used in the wild before, it seems that now bots are running in circles with those new toys

Judging by how the post feels, I is fitting here

Well, it's a start at least. That DFM module was the selling point of the project for me. It's neat to have something run on solar

Thing is, Fediverse is not a product

Looks fine on piefed.zip. Maybe some recent change broke something? IIRC content-in-post-bodywas how posts from nodebb were titled some time ago

Also https:// itsfoss.com/news/mastodon-link-problem/

Does it also happen in webui?

How much time has passed since the creation of the post you can't edit?

Yes, but from the page I linked

One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

It's not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

For sure that this is still a bug that should be patched. But I do remember "don't eval on user sent stuff" rule. Or is this really prevalent in PHP ecosystem?

Thanks! :)

Thank you for no spoilers!

From server's perspective the only difference between those is the user-agent. Traffic is the same

Yes, but then a comment mentioned the "hug of death" - high spike of requests resulting from a link being shared on some site, and OP asked why centralized sites were also creating problems

There was another post regarding previews some months/(knowing me probably a year) ago and personally I would go with federating previews. With a button for mods to refresh it from source for when something goes fucky

But social networks have been creating random bursts of requests, this way or another, even in the times of centralized socials

https://en.wikipedia.org/wiki/Slashdot_effect but people were going in, looking at the link, sometimes overwhelming the server