The most prestigious law school admissions discussion board in the world.
|
 |
 
|
How is XO affected by the recently-disclosed PHP vulnerability?
Poast new message in this thread
Date: October 21st, 2026 5:18 PM Author: ,.,..,.,..,.,.,.,..,.,.,,..,..,.,,..,.,,. this sounds pretty bad - these guys claim that the exploit is basically Heartbleed Part II, but for PHP instead of OpenSSL:
https://www.wiz.io/blog/php2shell-php-rce
The Vulnerabilities
All of the disclosed vulnerabilities are memory-safety issues that stem from bugs in how PHP handles fatal errors while processing requests, particularly out-of-memory errors. These bugs can leave a corrupted internal PHP state behind after a request ends unexpectedly. A later request or worker can reuse that stale state, leading to memory disclosure or corruption.
Below you can find a table that demonstrates what type of impact was demonstrated by each of the bugs we reported to PHP. The applications listed below are targets we chose for the RCE demonstrations. They are representative targets - exploitation does not require one of these CMSs, as the vulnerable code is in PHP itself.
Tracking ID: CVE-2026-109618. Bug: Upload-progress unserializer use-after-free; Remote process-memory disclosure. What an attacker can achieve: Corrupt process memory and execute code; Unauthenticated disclosure of PHP worker memory. What we demonstrated: Pre-authentication RCE on WordPress, Drupal and Joomla; Application-agnostic remote memory disclosure
Tracking ID: CVE-2026-109619. Bug: Fatal-error backtrace use-after-free; OPcache type confusion. What an attacker can achieve: Corrupt process memory and execute code; Corrupt shared PHP state and execute code. What we demonstrated: Pre-authentication RCE on Drupal; Pre-authentication RCE on WordPress
While this blog covers only four instances of exploitable bugs (grouped under two CVEs) that follow this problematic pattern, there are other tracked, and likely untracked, variants of this issue in the PHP codebase. These variants have different requirements for exploitation and can lead to different types of impact.
Impact
We combined these vulnerabilities into a single exploit script, php2shell, and demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupal:latest), and Joomla (joomla:latest), using their latest container images at the time of testing.
These platforms illustrate the impact, but the vulnerabilities are in PHP itself. Exploitation does not depend on a flaw in the application’s code: even a simple “Hello World” application running on an affected PHP version can be vulnerable.
Separately, we demonstrated that attackers could read sensitive data from the PHP process’s memory, including passwords, tokens, and API keys, without needing to achieve remote code execution.
https://www.datocms-assets.com/75231/1792535785-image-5.png?fm=webp
https://www.datocms-assets.com/75231/1792537190-image-7.png?fm=webp
https://www.youtube.com/watch?v=H7JWNiQpaT8
basically, if you're running unpatched PHP, any random retard can take over your site and data.
|
Date: October 21st, 2026 5:19 PM Author: Test It's going to get completely pwned any minute now (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200510) |
|
Date: October 21st, 2026 5:23 PM Author: ceo 4chan has been down for 20 hours so I'm coming here to indulge in my terminally online internet gossip habit (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200513) |
|
Date: October 21st, 2026 5:24 PM Author: hex its over, everyone go to the backup discord (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200514) |
 |
Date: October 21st, 2026 5:33 PM Author: ceo How is "Discord" not affected? (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200521) |
|
Date: October 21st, 2026 5:35 PM Author: hex b/c it doesn't run on 20 year old PHP code (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200522) |
|
Date: October 21st, 2026 5:36 PM Author: ceo I guess I'm just surprised it doesn't depend on things that run on PHP code Idk. I'm a Lawyer |
|
Date: October 21st, 2026 5:38 PM Author: hex idk it probably does, a lot of major sites have been hit with this (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200524) |
|
Date: October 21st, 2026 6:09 PM Author: bloomington (retired) (🦬) Versions of PHP released prior to 2004 aren't affected so this place might be fine due to how ancient it is (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200547) |
|
Date: October 21st, 2026 6:13 PM Author: Historical American One Weird Trick (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200550) |
|
Date: October 21st, 2026 7:02 PM Author: Test (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200614) |
|
Date: October 21st, 2026 7:07 PM Author: Nude Karlstack (🧐) (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200624) |
|
Date: October 21st, 2026 7:09 PM Author: censorship (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200625) |
|
Date: October 22nd, 2026 12:08 PM Author: .,.,.,.,,,,.,,.,.,.,...,,..,, Lol is this fr (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200664) |
|
Date: October 21st, 2026 7:06 PM Author: censorship our version of php is so old it actually predates the vulnerability (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200620) |
|
Date: October 21st, 2026 7:12 PM Author: The Penis you think rachmiel is still using a pre-2012 interpreter? hasn't updated at all? (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200628) |
|
Date: October 21st, 2026 7:14 PM Author: censorship rach never removed that backslash at the top left (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200631) |
|
Date: October 21st, 2026 7:14 PM Author: The Penis (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200632) |
|
Date: October 21st, 2026 7:14 PM Author: Historical American First day? (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200633) |
|
Date: October 21st, 2026 7:14 PM Author: The Penis there have been big changes. like when he added a condor. (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50200634) |
|
Date: October 26th, 2026 6:52 PM Author: Nude Karlstack (🧐) (http://www.autoadmit.com/thread.php?thread_id=5914417&forum_id=2#50204394) |