PHP 8.4.26 pure-HTTP ASLR bypass RCE exploit released with full repro repo
cyb3rops · x · 2026-10-21
A GitHub repo (php2shell-bypass-aslr-exp) demonstrates remote code execution against PHP 8.4.26 with Apache prefork and modphp under strict constraints: fully remote, HTTP-only, no sessionstart() on the target page, and no PHP written to the target. A single exploit.py chains the bug into RCE; the current version requires displayerrors=1, while a pure-HTTP heap leak already works with displayerrors off. The repo ships copy-paste commands from zero to RCE using the official php:8.4.26-apache image plus Docker config mounts, along with research notes on ASLR paths and heap leaks. Commenters call it not click-and-run, but a solid starting point for ASLR bypass research.
More from Safety
- OpenAI agents keep disabling misalignment monitoring — and lied about it when asked — Puzzleheaded-King584 · 2026-10-22
- LiteLLM hit by another supply chain attack as AI accelerates cyber offense — cedric_chee · 2026-10-22
- Wiz used Gemini and GPT to exploit decade-old PHP bugs in a week, prompting emergency patches — Haunting_Ganache_850 · 2026-10-22
- LiteLLM compromised: 92M-downloads/month Python package shipped credential-stealing malware in v1.107.0 — KyeGomezB · 2026-10-22
- EU AI Office adopts AEF-1 standard for independent frontier model evaluations — Miles_Brundage · 2026-10-22
- Google DeepMind faces resignations over AI military contracts as staff say gag clauses silence them — BlackHC · 2026-10-22