Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #94582

Re: PHP2Shell

Show all headers | View raw

The Natural Philosopher <tnp@invalid.invalid> writes:
> Hundreds of articles about it but none detailing exactly how the
> exploits work
> Anyone know?

The advisories sketch what the bugs look like:

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Briefly, error paths don’t clean up internal state adequately, and leave
invalid states (e.g. pointers to freed data, wrong array bounds, etc)
which can be exploited during subsequent requests.

More details, with (roughly) increasing levels of detail from one to the
next, can be found here:

https://www.wiz.io/blog/php2shell-php-rce
https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/
https://calif.io/php2shell/

-- 
https://www.greenend.org.uk/rjk/

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:16 +0100
  Re: PHP2Shell Andy Burns <usenet@andyburns.uk> - 2026-10-22 19:28 +0100
    Re: PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:36 +0100
      Re: PHP2Shell Andy Burns <usenet@andyburns.uk> - 2026-10-22 19:45 +0100
        Re: PHP2Shell The Natural Philosopher <tnp@invalid.invalid> - 2026-10-22 19:50 +0100
        Re: PHP2Shell doctor@doctor.nl2k.ab.ca (The Doctor) - 2026-10-23 01:59 +0000
  Re: PHP2Shell Richard Kettlewell <invalid@invalid.invalid> - 2026-10-22 19:58 +0100
    Re: PHP2Shell Nuno Silva <nunojsilva@invalid.invalid> - 2026-10-23 00:39 +0100

csiph-web