php2shell: HTTP-only PHP 8.4.26 RCE bypasses ASLR on stock Apache image
cyb3rops · x · 2026-10-22
The php2shell-bypass-aslr-exp GitHub repo (779 stars) demonstrates full RCE against PHP 8.4.26 + Apache prefork + modphp under strict constraints: fully remote, HTTP only, no sessionstart() on the target page, and no PHP written to the target. The official php:8.4.26-apache image was exploited 3/3 with a single exploit.py (proof: uid=33 www-data).
The exploit relies on memory corruption vs ASLR; earlier public PoCs were lab-only and limited to a one-worker php-fpm setup, but the author shows it scales to N workers by keeping N-1 workers busy. Current version requires displayerrors=1; a pure-HTTP heap leak for displayerrors=0 already works, with full RCE to follow.
Related event: Open-source repo demonstrates HTTP-only ASLR bypass RCE in PHP 8.4.26(2 posts)→
More from Safety
- Researcher: eMudhra's ISO27001 auditor's '3rd floor' office doesn't exist — kingslyj · 2026-10-22
- UK No 10 Seeks Adviser to Help Citizens Navigate the Rise of AI — ShakeelHashim · 2026-10-22
- How AI-pilled should defense be? Old-school best practices vs autonomous agent swarms — AaronBergman18 · 2026-10-22
- Oct 21 attacks on Railway and LiteLLM show AI defense now needs agentic ops — alvelda · 2026-10-22
- AI uncovers long-hidden PHP vulnerability, lowering the bar for exploit discovery — FuSheng_0306 · 2026-10-22
- Where should agent autonomy end? The gray zone beyond blocking dangerous APIs — Innowise_ · 2026-10-22