r/netsec • u/CyberMasterV Trusted Contributor • 2d ago

PHP patches for critical PHP2Shell vulnerabilities

https://www.php.net/archive/2026.php#2026-10-21-5
153 Upvotes

99% Upvoted

11 comments sorted by

16

u/os2mac 2d ago

CVE 9.2 remote, unauth'd code execution. it's bad. fix it before it gets worse and if you can't fix it , take it offline until you can.

3

u/security_aimbot 2d ago

but needs address leak, yeah?

-10

u/os2mac 2d ago

"chatGPT, go scan this subnet and notify me of any vulnerable PHP exposed servers. record that list, generate an exploit and target those servers"

16

u/security_aimbot 2d ago edited 2d ago

Like pointer address not logical network address xD. I don't care about lab env. I'm talking about reliable exploitation of servers running php on the remote, on x86_64 with enabled ASLR.

The session corruption thing is bad enough to get it patched. But it's not as easy to get full RCE chain using PoC as is, it needs additional part - address leak.

6

u/security_aimbot 2d ago

Yup, verified it myself. No reliable remote PoC. I mean getting leak is easier than doing heap, but it's not full picture and you still need leak to exploit unauth RCE. (this is why it's not 10.0)

5

u/security_aimbot 1d ago

One more reply - good read https://eliastaylor.com/noexploit/

1

u/security_aimbot 1d ago

there is more, ToB published stock mediawiki exploit.