Chris's Wiki :: blog
The hot tech news of the time interval is a major set of PHP vulnerabilities (also, also). One of the interesting aspects of this is that some of these issues can be exploited by performing actions that the PHP application itself doesn't support, for example file upload. As covered in this php2shell writeup, this enables a direct exploit of the Apache mod_php without application involvement, which means it works against arbitrary PHP scripts. Why this happens is that like essentially every web framework and even web server, PHP is performing some actions for convenience before your application even starts. So PHP will try to handle some aspects of the file upload for your convenience before your application gets a chance to refuse to accept a file upload. This isn't bad as such but it is a tradeoff. The sooner the framework invokes the application and the more control it gives the application, the more complexity the application is potentially exposed to even if that complexity is just