So, you (incorrectly) complain about a strawman attack, and of my command of English, but you actually said:

So, in the comment above, you literally said the thing verbatim you claimed not to say in this comment.

You've gone from insults (some of which you've walked back by conceding my infosec knowledge), to pitiful attempts to display a degree of infosec knowledge, to denials of verbatim text you've said in the parent comment. You then moved onto staking that your opinion rests on an unlikely, unfalsifiable scenario where a threat actor uses an exploit and remains undetected well past a low-severity patching window (six months), and well beyond industry-standard undetected "dwell time," which in 2026 is 14 days.

I would pinpoint your projection of "a lack of basic reasoning skills" to be exemplified by your false identification of a strawman attack here. Perhaps it's time you took a college class on logic and the nature of logical fallacies, before using the term "strawman" to refute an argument which in fact hinges on the exact language and logical premise you used.

It is rather ironic you talk about "reasoning skills and grasp of the English language..." but you supply a completely fabricated and incorrect definition of a successful exploit. A successful exploit is not one that cannot be detected. It is simply one that obtains access or privilege escalation. It is often not even the exploit itself that gets detected, it is the behavior associated with the hacker's activity after exploitation that is detected..e.g., modifiying system files to obtain persistence, exfiltrating data, anomalous activity patterns, and so forth.

Reference link

Aside from attacks from nation-state actors to obtain persistent feeds of intelligence and information, the vast majority of successful exploits are made with the threat actor actively wanting to announce the hack. This can be the case of ransomware (exploit happens, data encrypted/exfiltrated, ransom demanded..making the breach known), hackers doing it for the lulz (some of the recent ShinyHunters hacks, go read Krebs for more information), or those using those systems for malicious purposes such as spam, malware distribution, bitcoin mining etc, which are short-term gains the threat actor knows will eventually be detected and shut off.
Often, anomalous activity after the successful exploitation causes the compromise to become detected.

You have redefined "successful exploit" with your arbitrary definition which conveniently creates a boogeyman of this hidden threat actor that stays latent/persistent for a long term period without making their presence known or using their hacked access for any personal gain. Outside of intelligence/nation-state actors, this makes zero sense. Hacks are usually conducted with the intent of the victim eventually knowing about it so the threat actor can obtain some sort of monetary gain.

I suggest you consult a dictionary or actually google the term "successful exploit" before coming up with more word salad nonsense. This is again why I'm confident you couldn't pass any security certification exam, in addition to your outdated knowledge (thinking it's possible to succeed with an EPS32 etc implant in a datacenter, without factoring difficulty of C&C and exfiltration..perhaps you've never heard of a Bastille Networks or similar WIDS monitoring RF/5G/4g etc for exfiltration, as is present at most commercial datacenters); you're also arrogant enough to come up with your own definitions which are patently wrong.

Your grasp of information security is beyond subpar. See you in six months when there's no reported use of this exploit.

Or somebody downloaded an export file/csv and sent it to the wrong place or put it on a compromised device. Gee, a user listing from Okta. I think you could get most of that info searching LinkedIn.

I set a timer to deploy an AI agent to search to see if there's any record/information about this vulnerability being successfully exploited and causing a real breach (outside of a lab/test environment). Then necro this thread in six months.

You tried to use your highly limited knowledge to prove me wrong, but got your ass handed to you because you don't know what you're talking about. Rather than respond to my factual statements, you've reverted to schoolboy style insults again because that's where you feel safe and can maintain your air of arrogance and superiority, and avoid the cognitive dissonance of actually digesting my response and realizing you're dead wrong. Now I see where your demeanor comes from: you're unconfident in your technical knowledge (and should be) and prefer to degrade others on Slashdot, because that's far easier than actually knowing about infosec/tech in general and being able to defend your (shoddy, unrealistic) points.

Again, you're operating at a junior-analyst level of security knowledge. I've seen better from community college students.

1. That means its presence on a secure management network, which is probably (and should be) highly restricted and/or requires authentication e.g. like 802.1AE or Cisco MACSEC. That management network also probably has a NIDS on it, so plugging in such a device generating ICMP traffic will get it flagged in no time. Since almost all datacenters have complete, redundant camera coverage, identifying the person who planted such a device would be trivial. Did you advise the Saudi OpenAI employee who tried this in a conference room and now sits in a jail cell?

2. True, but it has to evade detection until a very short exploit window emerges, and avoid detection as the process to try to implant malware etc will make the server reboot take significantly longer.

3. This vulnerability isn't exploited by a boot USB, and no one said that (see: your reading comprehension problems), it was merely to illustrate the same level of privileged access can be used to execute a much easier hack not reliant upon this vulnerability. Note it also doesn't require the "skills" you describe, as the same remote C&C infrastructure your scenario depends upon can be used via a USB-style attack through the addition of a console plug.

4. The vulnerability above requires significant skills to exploit, at or above the level you describe for the boot USB, as it also requires you to implant your own malware at the time. Kali Linux is also not a USB-based "tool," it's a Linux distribution with a number of hacking tools pre-installed. Since you're so persnickety about grammar, it's quite ironic to see you make such a fundamental mistake which betrays your lack of knowledge on security tooling. In addition, the console is usually near the server in all except the largest datacenter environments, and even then it would be similar in location to the nearest switch one could patch into; again, on camera.

Secure Datacenter means a lot because those persons would be logged, subject to going through a man-trap, and on camera the entire time. It also requires the threat actor to be one of the personnel with such access, which also is a significant mitigating factor lowering the residual risk as I've described.

You also propose an EPS32 or similar device (perhaps a Hak5 Shark Jack?). That requires remote C&C capability. Typically management networks do not even have egress to the internet, as they don't need it, and in the rare instances they do they go across a gateway [NAT device/firewall/etc), which should also have NIDS on it. The C&C activity from a management network will again, be flagged in no time. Datacenters act as a faraday cage and traditional methods of out of band data exfiltration won't work, such as 5G connectivity to external cellphone antennas, or radio-frequency egress.

You've taken pains to create a word salad that might sound plausible to someone who isn't a professional, but this is laughable n00b talk; riddled with mistakes and false assumptions. Exploitation of this vulnerability on servers in a datacenter environment is extremely difficult and requires personnel with privileged access to even initiate, on top of the difficulty of remote C&C.

Your answer also reads like you stopped learning about InfoSec sometime in 2012, but with you spouting nonsense like this, I suspect you'd fail the entry-level Security+ and probably get booted out of the mid-level CISSP around question 40.

Do you know how to communicate facts rather than insults? Because all you seem to do is make up various insults without even making a basic attempt to prove/disprove anything, e.g. a realistic scenario this vulnerability can be exploited (you tried to claim someone could plug in a network cable...to a server in a secure datacenter, during a few -second reboot window where they'd already have physical access to plug in a malicious boot USB), or what is wrong with my statement grammatically (answer: absolutely nothing). You've demonstrated zero expertise in anything besides perhaps your depth into the autism spectrum, which you manage by writing out schoolboy-level insults to people on the internet. Off you go now to troll on the next person with your delusions of grandeur!

Ah, more insults, no facts to back it up. In high school I did receive a gold medal for the National Language Arts Olympiad, in addition to the best SAT verbal score in my class. There is nothing grammatically wrong with my statement. To directly speak to your nonsensical statement about mitigations, in nearly every environment these mitigations are already in place. You disregard that. Maybe you're projecting a severe reading comprehension problem.

I am objectively considered an expert in infosec, and I explained the other experts simply rated the technical risk, which roughly maps to the inherent risk. The residual risk, the risk after security mitigations are applied is low in essentially every environment. A CVSS score just measures technical risk. Perhaps you should take a single security certification class to learn about how information security management and risk ratings really work. Otherwise you're just insulting people based on your junior-grade knowledge.

You seem to really enjoy flinging insults at people but the knowledge you've displayed here would make you likely to fail the entry-level Security+. Numerous other posters, including myself, have laid out how it's basically low risk; to which you respond with juvenile insults. I'd wager you've never held a job title with the word "Security" in it.

Fraud is typically defined as willful misrepresentation of a material fact. The material fact being he could recover your data without actually paying the ransom. I've done this for clients many times, either recovering from backup, versioned storage, or recovering a poorly-generated private keys or symmetric encryption passwords. So it's possible, but he didn't do it, he chose to commit fraud and possibly also send money to foreign criminal entities under sanctions. So there's a couple levels of actual criminality here. He needs to go to the slammer and have his money taken for restitution/fines to dissuade others.

I would definitely put it in the "turn that off at the next maintenance window" bucket, but a good sysadmin (does this job title exist anymore? Infrastructure engineer? DevOps?) wouldn't just leave PXE boot on in the first place...if for no other reason after reboot the thing takes a few seconds longer to boot while it tries to discover a PXE server via DHCP.

No, I'm saying it's an unrealistic attack vector for any company even vulnerable by using PXE boot on servers in the first place. I illustrated why, and the difficulty/unlikelihood of successful exploitation, which involves obtaining privileged access to the management network, and a narrow attack window (the few seconds after boot) in the first place. Cyber security is a discipline of risk management, and while the inherent risk of the vuln being exploited is critical, with mitigations like the complexity I've described (and the presence of datacenter security, isolated networks etc) make the residual risk low. But I'll leave it to you sir, who can't tell a critical vuln from a high and comes up with preposterous exploration scenarios, to be the expert! Again please necro in 6 months so we can see if there's a single report of anyone in a non-lab environment experiencing a breach due to this vulnerability being exploited. There's still coffee in it for you..

They need to plug a network cable into a restricted server management network (which should have security on it, at the least), which in the case of plugging in a cable should mean they are present in your datacenter, with scripts queued up and ready waiting to exploit this in a few-second window after a server has rebooted. Then they need good quality persistent malware to implant and a way to C&C it. Servers don't just reboot all the time in datacenters, or even the remaining on-prem server rooms (which are far less likely to have PXE enabled in the first place) so anyone able to do the above probably already has privileged access to the server environment. Why not just boot the server off a USB image to implant your malware if you have this level of access, and there needs to be a reboot?

I was not among the doubters of php2shell, I moved my last WordPress site to React/Vite with 8 hours of reading about it. Critical bugs on internet-facing sites are no joke. Industry-wide, it's only CRITICAL internet facing vulnerabilities that get the rush to patch treatment. For critical (this one is scored critical, not high), on internal systems, it's 7-30 days. There's always a percentage of vulns that don't meet SLA, and this is going to be one because of the difficulty patching, meaning taking servers offline to update firmware. That's even weighing the risk of malicious employees...chances are if they can get into a privileged position on the network like this, they have administration capabilities anyway. Or, there are better/easier ways for an insider threat to get access than wait for a server to reboot and exploit this vulnerability in the narrow few-second time window upon reboot when it's even possible. Rushing to patch any vuln without weighing the real risk is the stuff of junior security people who have never sat in a CISO or director etc chair. Please necro this thread in six months. If it has been exploited in a significant breach by then, I will buy you coffee for a month.