Post by @wdormann@infosec.exchange

2026-10-22 19:29 UTC

In the ever-growing sea of AI slop exploits out there, this is the closest I've seen to being viable: https://github.com/9bie/php2shell-bypass-aslr-exp With two large caveats: 1) It requires specific, albeit plausible, configuration options for PHP. 2) It appears to requires specific knowledge of the specific PHP code running on the target system. With these two caveats, yeah, you can get code execution. Without them, good luck? At least with what I've seen so far, I've not seen any evidence that there's a universal exploit for this. It's possible that this vulnerability may be able to be combined with another vulnerability in a popular platform to achieve universal reliably. But I don't think we're even there yet.

Replies (1)

@wdormann@infosec.exchange 2026-10-26 14:40

There was a steal my bitcoin challenge which offered some bitcoin if the PHP instance could be compromised. It was won after 19.28 hours. The solution exploit has been posted, which I've confirmed to work. From the exploit: The offsets and multipart shapes are calibrated for the challenge's observed Alpine PHP 8.4.26 layout. Which was presumably observable from the live server. The exploit targets a combination of stock nginx:1.27-alpine and php:8.4.26-fpm-alpine3.23 docker images that talk to each other via the php development CLI server. Note that this is probably not representative of what you might see in the real world, and more like what you might see in a CTF. However, what you might see in the real world with a real product might be even more terrifying, such as current products that are built on FreeBSD versions too old to even support ASLR.

Open ##5256392