Post by @mttaggart@infosec.exchange

2026-10-22 14:50 UTC

Here's what I basically have so far: Most of the attack logs you see online are folks firing off the GitHub PoCs.The GitHub PoCs are junk.I have one (1) PoC that reliably produces a crash, but requires very specific conditions to do anything else, and even then it's hit-and-miss. I'm not certain how globally exploitable this really is.

Replies (1)

@mttaggart@infosec.exchange 2026-10-22 17:10

I have arrived at a working PoC based on a GitHub repo. But there are signficant caveats. You need 3 precise things to make it work. Initial offsets for functions are PHP version-specific, so you need those going in. That's annoying but easy.Heap layout constants based on Zend MM's memory layout for the PHP build. You get this with GDB precisely on a PHP instance you control, or fuzzing a target—messy.The specific shape of the payload to hit the OOM at the right point. This is largely based on memory limit settings in php.ini. So there's some prior work to hit a vulnerable target. A PHP offset "rainbow table" may be somewhere or getting built, but those specifics may explain the lag in clear evidence of exploitation.

Open ##5202947