Calif's php2shell writeup traces two PHP RCE bugs back to a 2004 memory-limit bug
Zulfikar_Ramzan · x · 2026-10-22
hdmoore recommends Calif Research's php2shell writeup as the most detailed AND entertaining account of the php2shell bugs — two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619) found by Calif, OpenAI, and Wiz, fixed in PHP's October 2026 security release.
- 2004 origins: Stefan Esser found the first PHP memory-limit RCE, too critical to release publicly; only CORE and Immunity built private exploits, with fake ones circulating on IRC
- 2020: seemingly harmless bug #78876 (OOM-related) plants the seed
- Told in comic-panel form, tracing how PHP's classic unserialize() UAF / POP injection attack surface got patched out — and how these two bugs grew from that history
More from Safety
- OpenAI proposes six amendments to California's SB 53, covering RSI, shutdown controls, audits — ShakeelHashim · 2026-10-22
- Google Explains robots.txt Rules for AI Crawlers, Emojis, International URLs — OnlineInference · 2026-10-22
- Should Every Agent Get Its Own Identity and Short-Lived Scoped Credentials? — iamjessew · 2026-10-22
- How do you verify the model you downloaded is what you think it is? — iamjessew · 2026-10-22
- Veracode report: AI now writes half of committed code but only 56% pass security checks — WeldPond · 2026-10-22
- Researcher Warns AI Cyberattacks on Grid Possible Within a Year, Shares Prep List — cephaloform · 2026-10-22