Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
It’s not resolved until everyone installs the patch. And there in lies the problem.
An important point yes and I do understand that, but the major players like Steam were updated and done before I knew it. I have no doubt this could come back to bite companies/people lagging behind over the next few years, but the impact to me from websites being taken down was 0, which was my point.
The companies with well-resourced dev teams would have been able to deal with it. But for every one of those there’s 50 companies with no dev team who are sending frantic emails to the guy who quit 3 years ago asking if he’s available for some urgent work. And another 50 that are not sending any emails because they’re oblivious and will get pwned in a few months.
A lot of PHP apps are old, unmaintained or run by people with no idea. That’s kinda it’s niche.
Yeah but this wasn’t an exploit in PHP applications, this was an exploit in PHP.
Our resolution was to unzip a new directory and change the path to PHP in Apache conf
Not entirely accurate. I happen to be my company’s 1 man IT army, and I got it all plugged within 4 hours (php2shell, CA certificates, which I only had to rotate, etc). It was bad, but the noise was even worse. If IT departments are proactive and do their jobs, the actual problems should be little to none.
Then I did the same in my proxmox, everything is just fine.