PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable
Security researchers report that PHP 8.5.12's October security fix for the php2shell double-free vulnerability is incomplete, with at least three exploitation paths confirmed still working on the patched release.
2026-10-22 ~ 2026-10-22 · 2 related posts
- Episode 1: PHP Rushes Fixes for Two Unauthenticated RCE Flaws, Discovered with Help of OpenAI Models(2026-10-21, 64 posts)
- Episode 2: Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities(2026-10-21, 3 posts)
- Episode 3: PHP RCE proof-of-concept confirmed working, but not one-click(2026-10-21, 2 posts)
- Episode 4: POC Released for Critical Pre-Auth RCE in PHP session.upload_progress(2026-10-21, 2 posts)
- Episode 5: PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable(2026-10-22, 2 posts)
- PHP 8.5.12 security patch incomplete: three exploit paths survive, lab-confirmed — jedisct1 · 2026-10-22
- PHP 8.5.12 may still be vulnerable to php2shell, researchers report — basedjensen · 2026-10-22