The most prestigious law school admissions discussion board in the world.
|
 |
 
 10 posters qualify.
You have 0 points. Copying this list does not send funds. Paste it on Disperse, then connect your wallet there. |
How is XO affected by the recently-disclosed PHP vulnerability?
Poast new message in this thread
Date: October 21st, 2026 5:18 PM Author: Brilliant erotic locale psychic this sounds pretty bad - these guys claim that the exploit is basically Heartbleed Part II, but for PHP instead of OpenSSL:
https://www.wiz.io/blog/php2shell-php-rce
The Vulnerabilities
All of the disclosed vulnerabilities are memory-safety issues that stem from bugs in how PHP handles fatal errors while processing requests, particularly out-of-memory errors. These bugs can leave a corrupted internal PHP state behind after a request ends unexpectedly. A later request or worker can reuse that stale state, leading to memory disclosure or corruption.
Below you can find a table that demonstrates what type of impact was demonstrated by each of the bugs we reported to PHP. The applications listed below are targets we chose for the RCE demonstrations. They are representative targets - exploitation does not require one of these CMSs, as the vulnerable code is in PHP itself.
Tracking ID: CVE-2026-109618. Bug: Upload-progress unserializer use-after-free; Remote process-memory disclosure. What an attacker can achieve: Corrupt process memory and execute code; Unauthenticated disclosure of PHP worker memory. What we demonstrated: Pre-authentication RCE on WordPress, Drupal and Joomla; Application-agnostic remote memory disclosure
Tracking ID: CVE-2026-109619. Bug: Fatal-error backtrace use-after-free; OPcache type confusion. What an attacker can achieve: Corrupt process memory and execute code; Corrupt shared PHP state and execute code. What we demonstrated: Pre-authentication RCE on Drupal; Pre-authentication RCE on WordPress
While this blog covers only four instances of exploitable bugs (grouped under two CVEs) that follow this problematic pattern, there are other tracked, and likely untracked, variants of this issue in the PHP codebase. These variants have different requirements for exploitation and can lead to different types of impact.
Impact
We combined these vulnerabilities into a single exploit script, php2shell, and demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupal:latest), and Joomla (joomla:latest), using their latest container images at the time of testing.
These platforms illustrate the impact, but the vulnerabilities are in PHP itself. Exploitation does not depend on a flaw in the application’s code: even a simple “Hello World” application running on an affected PHP version can be vulnerable.
Separately, we demonstrated that attackers could read sensitive data from the PHP process’s memory, including passwords, tokens, and API keys, without needing to achieve remote code execution.
https://www.datocms-assets.com/75231/1792535785-image-5.png?fm=webp
https://www.datocms-assets.com/75231/1792537190-image-7.png?fm=webp
https://www.youtube.com/watch?v=H7JWNiQpaT8
basically, if you're running unpatched PHP, any random retard can take over your site and data.
|
Date: October 21st, 2026 5:19 PM Author: Pale Disrespectful Cruise Ship Alpha It's going to get completely pwned any minute now (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200510) |
|
Date: October 21st, 2026 5:23 PM Author: ceo 4chan has been down for 20 hours so I'm coming here to indulge in my terminally online internet gossip habit (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200513) |
|
Date: October 21st, 2026 5:24 PM Author: Bonkers Obsidian Area its over, everyone go to the backup discord (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200514) |
 |
Date: October 21st, 2026 5:33 PM Author: ceo How is "Discord" not affected? (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200521) |
|
Date: October 21st, 2026 5:35 PM Author: Bonkers Obsidian Area b/c it doesn't run on 20 year old PHP code (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200522) |
|
Date: October 21st, 2026 5:36 PM Author: ceo I guess I'm just surprised it doesn't depend on things that run on PHP code Idk. I'm a Lawyer |
|
Date: October 21st, 2026 5:38 PM Author: Bonkers Obsidian Area idk it probably does, a lot of major sites have been hit with this (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200524) |
|
Date: October 21st, 2026 6:09 PM Author: Pearl bearded factory reset button pisswyrm Versions of PHP released prior to 2004 aren't affected so this place might be fine due to how ancient it is (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200547) |
|
Date: October 21st, 2026 6:13 PM Author: irate round eye One Weird Trick (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200550) |
|
Date: October 21st, 2026 7:02 PM Author: Pale Disrespectful Cruise Ship Alpha (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200614) |
|
Date: October 21st, 2026 7:07 PM Author: exhilarant rough-skinned ceo (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200624) |
|
Date: October 21st, 2026 7:09 PM Author: Boyish sneaky criminal (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200625) |
|
Date: October 22nd, 2026 12:08 PM Author: Wonderful corn cake kitchen Lol is this fr (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200664) |
|
Date: October 21st, 2026 7:06 PM Author: Boyish sneaky criminal our version of php is so old it actually predates the vulnerability (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200620) |
|
Date: October 21st, 2026 7:12 PM Author: flickering stead old irish cottage you think rachmiel is still using a pre-2012 interpreter? hasn't updated at all? (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200628) |
|
Date: October 21st, 2026 7:14 PM Author: Boyish sneaky criminal rach never removed that backslash at the top left (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200631) |
|
Date: October 21st, 2026 7:14 PM Author: flickering stead old irish cottage (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200632) |
|
Date: October 21st, 2026 7:14 PM Author: irate round eye First day? (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200633) |
|
Date: October 21st, 2026 7:14 PM Author: flickering stead old irish cottage there have been big changes. like when he added a condor. (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50200634) |
|
Date: October 26th, 2026 6:52 PM Author: exhilarant rough-skinned ceo (https://xoxohth.com/thread.php?thread_id=5914417&forum_id=2#50204394) |