PHP WASM sandbox scores 9.5/10 against automated exploitation, even unpatched
MickeySteamboat · x · 2026-11-03
- An evaluation of PHP2SHELL automated internet exploitation found a near-completely neutralized attack surface (9.5/10) even on unpatched PHP 8.3.32.
- The key: using PHP WASM without a process-spawn handler turns what is normally an instant automated Linux root/shell compromise on standard php-fpm stacks into a hard target that breaks off-the-shelf exploits.
- A few "soft spots" were identified; action has been taken despite near-impossible exploitability.
- Full release coming in the following days, with some details withheld for security reasons.
More from Safety
- worldinmotion: open-source MCP server for encrypted agent-to-agent messaging across machines, with no approve tool by design — distronode · 2026-11-04
- Google's planning AI pilot cuts officer assessment time 58%, 70% of reports accepted unedited — nukebuddy · 2026-11-04
- Dean Ball's OpenAI job: "AGI-pilling" the global affairs team — ShakeelHashim · 2026-11-04
- MIT: 32% of world's 100 largest companies acknowledge no AI risks — Exp_Mark · 2026-11-04
- LukeW open-sources a vulnerability-scanner agent built by adapting a security model's training code — LukeW · 2026-11-04
- CrowdStrike CEO Announces AI Kill Switch to Halt Any Agent at Runtime — yenkel · 2026-11-04