alt Hacker NewsThe point is, under normal configurations when you're serving the PHP server correctly with table-stakes best practices the server is not exploitable
This was not a scary vuln at all.
Replies
Urd- • today at 2:51 PM
Normal configuration of a PHP server is to not run any PHP code and serve a static html file?
➕ show 1 reply
cowlevel • today at 2:09 PM
Which best practices did you use to prevent exploitability?
And would you stake your bitcoin on it?
Under normal configurations the server is highly exploitable.
It's a horrible vuln and I don't understand what's with all the flat infosec society coming out of the woodwork.
The challenge server had vibe coded infra that made it hard or impossible to hack, but it was a configuration that can't be used in production and no one uses ( it was deployed as a PHP static content server instead of a dynamic site generator )