4 ms·

>a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month I find this to be a very upsetting attempt at technical

>a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month I find this to be a very upsetting attempt at technical clickbaiting. Feels like a journalist trying to appeal to semitechnical readers with hackerman slang. If it was known for a month, it's not an 0day.

kjeetgill 8y ago
Huh, doesn't making it publicly known before patching it in PHP constitute a 0day? Or by unpatched did they mean patched upstream but not here?
- busterarm 8y ago
  This is one that people have been getting wrong for decades. "A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability (including the vendor of the target software)" Patching and knowing about the vulnerability are different things. And so, this is not 0day.
  - YouKnowBetter 8y ago
    No idea why you are getting downvoted, since this perfectly acceptable explaination of a 0-day.
PeterisP 8y ago
The article does say that it became widely known only the day before the attack. Day zero starts counting from the time where either the developers/maintainers of the system or the general public are informed about the vulnerability. If the vulnerability has been discussed in some private forums or exploited by a NSA for many years, it doesn't matter, it's still day zero until it goes public (or privately disclosed to, in this case, maintainers of PHP). And as the attack was something like ~24 hours after disclosure, it's close enough to call it a zero-day attack.
SmellyGeekBoy 8y ago
Surely all 0days are known about by someone for some period of time before they actually get used? Or do you think people discover these exploits and then use them on the same day? My understanding was that 0day just meant that it was unpatched, not "publicly" known and being used for the first time "in the wild".

kjeetgill 8y ago

Huh, doesn't making it publicly known before patching it in PHP constitute a 0day? Or by unpatched did they mean patched upstream but not here?

busterarm 8y ago
This is one that people have been getting wrong for decades. "A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability (including the vendor of the target software)" Patching and knowing about the vulnerability are different things. And so, this is not 0day.
- YouKnowBetter 8y ago
  No idea why you are getting downvoted, since this perfectly acceptable explaination of a 0-day.

PeterisP 8y ago

The article does say that it became widely known only the day before the attack. Day zero starts counting from the time where either the developers/maintainers of the system or the general public are informed about the vulnerability. If the vulnerability has been discussed in some private forums or exploited by a NSA for many years, it doesn't matter, it's still day zero until it goes public (or privately disclosed to, in this case, maintainers of PHP). And as the attack was something like ~24 hours after disclosure, it's close enough to call it a zero-day attack.

SmellyGeekBoy 8y ago

Surely all 0days are known about by someone for some period of time before they actually get used? Or do you think people discover these exploits and then use them on the same day? My understanding was that 0day just meant that it was unpatched, not "publicly" known and being used for the first time "in the wild".