5 ms·
0-day vulnerability on WordPress 3.x (remote command execution)
- deleted 16y ago[deleted]
- nbpoole 16y agoLying about a highly dangerous 0-day in a very widely distributed piece of software seems in bad taste, even for April Fools Day.
- fredoliveira 16y agoparticularly when you also implicate someone specific in the process.
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- nhoss2 16y agoThere is no wp-att.php ;)
- nbpoole 16y agoIndeed. The danger is that people will read "0 day" and start freaking out. If you actually read the post, you see a couple warnings signs: 1. They claim it's part of a larger conspiracy and that people should sue Automattic. 2. The "vulnerable" filename is wp-att.php, as in AT&T 3. They point out that the MD5sums to trigger this behavior come from the words "remote_control" and "nsa" But even noticing that, I still felt the need to log in to my server and make sure the file didn't actually exist; when someone cries "0 day", it would be irresponsible of me not to, no matter how crazy they sound.
- sucuri2 16y agoNot lying, just a joke :) Specially when you blame their lead dev, ATT and the NSA... Hard to believe :)
- deleted 16y ago[deleted]
- mikecane 16y agoOK, if that was April Fool's, it's in very, very bad taste. People like me who aren't hackers or technically savvy will take it seriously. I tweeted it around. At the end they could have at least said April Fools, FFS!
- deleted 16y ago[deleted]
- nbpoole 16y agoI can't vouch for anyone else, but there were no comments when I originally looked at the post.
- cheald 16y agoThere's April Fool's jokes, and there's "seriously nasty month-ruining unpatched exploit in the wild". This is not a good example of the former.