Post by @fedops@fosstodon.org

Paul Wilde
@paul
Public en

Although I don't install nor maintain #PHP services for my clients, I still feel it's necessary for me to inform clients about the current #php2shell issue for things I know they have i.e. WordPress websites

Sent a message out, informing them and advising them to ask their website providers to take the services offline for the duration and I have received back... NOTHING! Silence.
Sites still online and ready to be hacked. This might be an interesting afternoon, we'll see I guess.

Replying to @paul
Paul Wilde
@paul
Public en edited

@paul turns out I had more PHP than I thought I did

Most of it is internal use only so comparatively safe, and those that aren't are either off or blocked from the outside for now.

I really should do a proper #SBOM one of these days - anybody know any good tools?

Replying to @paul
fedops 💙💛
@fedops @fosstodon.org
Public en

@paul we're looking at Syft. Popey works for them I think. Looks good so far, for machines as well as containers.

anchore.com/opensource/

Replying to @fedops@fosstodon.org
Paul Wilde
@paul
Public en

@fedops@fosstodon.org oh yeah! i've heard popey talk about that. Might be worth a look. Thanks.