Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.misc > #94574
| From | Andy Burns <usenet@andyburns.uk> |
|---|---|
| Newsgroups | comp.os.linux.misc |
| Subject | Re: PHP2Shell |
| Date | 2026-10-22 19:28 +0100 |
| Message-ID | <njv2tnFjpo3U1@mid.individual.net> (permalink) |
| References | <11bdjto$13lnp$1@dont-email.me> |
The Natural Philosopher wrote: > Hundreds of articles about it but none detailing exactly how the > exploits work > Anyone know? Don't think full details have been released yet because the fix got leaked before the time the embargo was due to be lifted (about now rather than yesterday). Some hints in the CVEs ... "PHP enforces its user-configurable memory_limit by using longjmp() to abort any request that exceeds the limit, which raises an OOM error. This can interrupt PHP while internal request data is only partially initialised" "Internal state owned by a request can survive after its backing memory has been freed, for example after a fatal error. A later request handled by the same worker may use that stale state before normal initialisation resets it."
Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:16 +0100
Re: PHP2Shell Andy Burns <usenet@andyburns.uk> - 2026-10-22 19:28 +0100
Re: PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:36 +0100
Re: PHP2Shell Andy Burns <usenet@andyburns.uk> - 2026-10-22 19:45 +0100
Re: PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:50 +0100
Re: PHP2Shell doctor@doctor.nl2k.ab.ca (The Doctor) - 2026-10-23 01:59 +0000
Re: PHP2Shell Richard Kettlewell <invalid@invalid.invalid> - 2026-10-22 19:58 +0100
Re: PHP2Shell Nuno Silva <nunojsilva@invalid.invalid> - 2026-10-23 00:39 +0100
csiph-web