{"id":9316,"date":"2025-09-26T21:53:18","date_gmt":"2025-09-26T19:53:18","guid":{"rendered":"https:\/\/lautfunk.uber.space\/?p=9316"},"modified":"2026-03-05T20:49:06","modified_gmt":"2026-03-05T19:49:06","slug":"als-die-seite-atmete-dann-spuckte-sie-php-podlove-exploit","status":"publish","type":"post","link":"https:\/\/lautfunk.uber.space\/en\/als-die-seite-atmete-dann-spuckte-sie-php-podlove-exploit\/","title":{"rendered":"As the page breathed, it spit PHP \u2013 Podlove exploit"},"content":{"rendered":"

How a Podlove exploit temporarily paralyzed my site \u2013 and how I tamed it<\/strong><\/p>\n\n\n\n

As the operator of several WordPress sites and Podlove instances, you have certain rituals: regular backups, updates, and the stoic certainty that technology usually fits in \u2014 until it doesn\u2019t. At the end of September 2025, this certainty was confirmed by a highly critical vulnerability in Podlove Podcast Publisher<\/em> Abruptly disturbed (CVE-2025-10147). What initially turned out to be \u2018funny behaviour\u2019 of the media files turned out to be a targeted exploitation of a missing file type validation: Attackers could use the image cache function to send arbitrary files, including PHP scripts, to the server. NVD+1<\/a><\/p>\n\n\n\n\n\n\n\n

\n\n\n\n

What I observed first \u2014 strange cache symptoms<\/h2>\n\n\n\n

On the main page of my Multisite installation<\/span> Suddenly the Podlove-Cache<\/span>-Pictures: Podcast logo, avatar, donation icons \u2014 all gone. The behavior was not only irritating, it was an indicator of inconsistent cache states and possible manipulation. Logs showed conspicuous accesses to Podlove cache endpoints with unusual query parameters \u2014 a puzzle that wanted to be assembled.<\/p>\n\n\n\n

In short: the main page appeared to be affected \u2014 a classic case where an exploit works selectively via cache mechanisms.<\/p>\n\n\n\n

\ud83c\udfa7 Also available as podcast<\/h2>\n\n\n\n
\n

You don't just want to read my experience, you want to hear it? I have written this story extensively on the podcast. \u2018The digression #61<\/a>\u201c<\/strong> narrated. There I go through step by step how the attack took place, what traces it left and how I secured my site again.<\/p>\n<\/blockquote>\n\n\n\n

\n

\ud83d\udc49 Listen in and experience the analysis in O-tone.<\/p>\n<\/blockquote>\n\n\n\n

\n
\n
\n <\/show-title>\n <\/episode-title>\n <\/subscribe-button>\n <\/poster>\n <\/divider>\n <\/div>\n\n
\n
\n <\/poster>\n <\/div>\n
\n
\n
\n
\n <\/show-title>\n <\/episode-title>\n <\/div>\n <\/subscribe-button>\n <\/div>\n <\/divider>\n <\/div>\n
\n <\/play-button>\n