I can tell you that every docker container we had running was vulnerable, and none had new versions as of around noon today.

The manual fix is relatively easy, just change a few configs.

Using a tool like Shodan, I can quickly get a list of addresses that have a specific version of PHP behind it.

It sounds like this is a cvss 9.0 or higher for PHP which is bonkers because PHP is such a huge amount of the internet.

My guess is releasing these CVEs the normal way could have catastrophic consequences. They’re giving stsadmins a heads up so there is less of a scramble when sysadmins read “hey fix your shit it’s totally vulnerable” before they have their coffee.

Like as a sysadmin, this is a great way for them to do this.

I will in 10 mins alert my team that the whole site has to come offline for a period today. I don’t need to take it offline in an emergency and tell my boss to send out a memo.

Literally a single nmap command will tell me where you “hid” your ssh port.

Like the poster you’re responding to said, it is good advice but not for security. It takes you off the hacker spam list, essentially.

Rereading this it sounds like I am disagreeing with you sorry. Just trying to reiterate your point.

Because it isnt easy. Because very few people enjoy reading error logs. Because convenience is a thing.

I don’t know if anyone’s told this to you before, but IT related things do not appeal to even half of people. Less than a quarter for sure.

We’re the strange ones. As confrontational to logic as that might sound. We as self hosters are in no way representative of the general population.

Use authelia for 2fa

Disable root ssh

Disable password authentication for ssh. Keys only.

Set up Fail2ban

That’s about all that’s left; 2fa and brute force protection. Good job.

No college has real prestige.

They’re all just political book clubs.