/
← Voltar ao feed
critical

PHP2Shell: Wiz Research discloses critical memory-safety flaws in PHP core enabling unauthenticated RCE (CVSS up to 9.2)

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 10:59 · coletado há 1 dia

Wiz Research disclosed multiple memory-safety vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, and patched by the PHP team on October 21, 2026. The flaws allow unauthenticated remote code execution or disclosure of process memory (passwords, tokens, API keys, certificates) on any site running an affected PHP version. Every PHP release from 5.4 onward is affected by at least one of the issues. Wiz chained the bugs into an exploit script, php2shell, and demonstrated pre-authentication RCE against the latest container images of WordPress, Drupal and Joomla; the flaws are in PHP itself, so even a "Hello World" application is exposed. The research used frontier AI models (Gemini 4 Argon, GPT-5.6 Sol, Wiz Atlas) to build and adapt the exploit chain, which Wiz says sharply lowers the effort needed to weaponize complex memory bugs. The article does not report in-the-wild exploitation, and it does not name the CVE identifiers.

Detalhes técnicos

  • Root cause: PHP mishandles fatal errors, particularly out-of-memory errors, during request processing. This leaves stale internal state that a later request or worker on the same process reuses, causing memory disclosure or corruption.
  • Upload-progress unserializer use-after-free: Session upload-progress handling decodes data into BG(unserialize). An allocation failure destroys the request heap but leaves the global published, giving a memory-corruption primitive. Combined with the memory disclosure, it yields unauthenticated RCE on WordPress, Drupal and Joomla.
  • Remote process-memory disclosure: RFC1867 multipart parsing at request startup can leave PS(id) pointing to freed memory. A later multipart request URL-encodes the reclaimed heap contents into a PHPSESSID response cookie. This works even if the application never calls session_start().
  • Fatal-error backtrace use-after-free: EG(last_fatal_error_backtrace) is not cleared after a fatal OOM error, producing a cross-request use-after-free. Wiz demonstrated unauthenticated RCE against Drupal with it.
  • OPcache type confusion: An allocation failure in zend_accel_script_persist() leaves CG(map_ptr_last) advanced locally but not published to the shared frontier. This causes cross-worker type confusion and corrupts shared OPcache state. Wiz used it for unauthenticated RCE on WordPress.
  • Other tracked and untracked variants exist; the PHP patch addresses the underlying pattern.
  • Detection hints: unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn. Application logs may hold little context because the issues occur below the application layer.

Remediação

  • Apply the PHP security update released October 21, 2026; Wiz states it is the only complete remediation.
  • Where patching is not immediately possible, use the guidance and mitigations prepared with Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft and Vercel.
  • Hunt for the indicators above in the interim.

Linha do tempo

  1. wiz.io ↗ · pub. 21/10/2026 10:59 · coletado 21/10 12:01 primeiro registro

    PHP2Shell: Wiz Research discloses critical memory-safety flaws in PHP core enabling unauthenticated RCE (CVSS up to 9.2)

    ler a análise desta fonte

    Wiz Research disclosed multiple memory-safety vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, and patched by the PHP team on October 21, 2026. The flaws allow unauthenticated remote code execution or disclosure of process memory (passwords, tokens, API keys, certificates) on any site running an affected PHP version. Every PHP release from 5.4 onward is affected by at least one of the issues. Wiz chained the bugs into an exploit script, php2shell, and demonstrated pre-authentication RCE against the latest container images of WordPress, Drupal and Joomla; the flaws are in PHP itself, so even a "Hello World" application is exposed. The research used frontier AI models (Gemini 4 Argon, GPT-5.6 Sol, Wiz Atlas) to build and adapt the exploit chain, which Wiz says sharply lowers the effort needed to weaponize complex memory bugs. The article does not report in-the-wild exploitation, and it does not name the CVE identifiers.

    Technical Details

    • Root cause: PHP mishandles fatal errors, particularly out-of-memory errors, during request processing. This leaves stale internal state that a later request or worker on the same process reuses, causing memory disclosure or corruption.
    • Upload-progress unserializer use-after-free: Session upload-progress handling decodes data into BG(unserialize). An allocation failure destroys the request heap but leaves the global published, giving a memory-corruption primitive. Combined with the memory disclosure, it yields unauthenticated RCE on WordPress, Drupal and Joomla.
    • Remote process-memory disclosure: RFC1867 multipart parsing at request startup can leave PS(id) pointing to freed memory. A later multipart request URL-encodes the reclaimed heap contents into a PHPSESSID response cookie. This works even if the application never calls session_start().
    • Fatal-error backtrace use-after-free: EG(last_fatal_error_backtrace) is not cleared after a fatal OOM error, producing a cross-request use-after-free. Wiz demonstrated unauthenticated RCE against Drupal with it.
    • OPcache type confusion: An allocation failure in zend_accel_script_persist() leaves CG(map_ptr_last) advanced locally but not published to the shared frontier. This causes cross-worker type confusion and corrupts shared OPcache state. Wiz used it for unauthenticated RCE on WordPress.
    • Other tracked and untracked variants exist; the PHP patch addresses the underlying pattern.
    • Detection hints: unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn. Application logs may hold little context because the issues occur below the application layer.

    Remediation

    • Apply the PHP security update released October 21, 2026; Wiz states it is the only complete remediation.
    • Where patching is not immediately possible, use the guidance and mitigations prepared with Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft and Vercel.
    • Hunt for the indicators above in the interim.