Archive for January, 2012
PHP Hash attack security issue through POST/GET variables
January 16th, 2012 | 
Author: A number of security researchers have provided a way to craft HTTP requests which take down a PHP-based web server completely. The idea is that essentially a specially constructed set of POST variables can completely put any web server into a never-ending CPU spin.
The newest version of PHP, PHP 5.3.9, has a patch for this, but we were already using a security filter called "suhosin" which limited POST (etc) variables nicely. Read the rest of this entry »
Posted in 