PHP2Shell by Calif Research
PHP >= 5.4.0 RCE PHP can leave dangling pointers/state when an allocation would exceed memory_limit, or another fatal error interrupts native code before its normal cleanup completes. Request shutdown may then free memory that surviving state still references. To reach an exploitable state we found two general OOM/memory_limit based fatal producers and three different interruptible points in the
PHP >= 5.4.0 RCE PHP can leave dangling pointers/state when an allocation would exceed memory_limit, or another fatal error interrupts native code before its normal cleanup completes. Request shutdown may then free memory that surviving state still references. To reach an exploitable state we found two general OOM/memory_limit based fatal producers and three different interruptible points in the interpreter that can leave a stale/consumable state that allows leaking memory and remote code execution. The earliest affected path we found dates to PHP 5.4.0; the available exploitation paths…
related reading
- php situation is insaneyoutube.com
- Greg Brockman on X: "Towards securing the internet" / Xx.com
- Reading privileged memory with a side-channel - Project Zerogoogleprojectzero.blogspot.com
- Vulnerability Research Is Cooked - Quarrelsomesockpuppet.org
- Zenbleedlock.cmpxchg8b.com
- GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blogwiz.io
- From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code - Project Zerogoogleprojectzero.blogspot.com
- Hacking OpenAIhacktron.ai
- Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incidentyoutube.com
- [2608.09867] Stealing Reasoning Traces from Proprietary LLM APIsarxiv.org
- Multiple Vulnerabilities in Rocket Software UniData's UniRPC server (Fixed) | Rapid7 Blograpid7.com
- Security incident disclosure — July 2026huggingface.co