---
id: 10266
title: "PHP 8.5.5: var_destroy __destruct Reentrancy Heap UAF and Exploitation"
severity: high
vendor: "PHP"
product: "PHP"
affected_versions: "PHP 8.5.5 (likely 7.x - 8.5.x)"
source_domain: github.com
source_url: "https://github.com/dinosn/php-8.5.5-var_destroy-uaf"
published_at: "2026-05-02T16:39:14Z"
tags: ["rce", "php", "exploitation", "poc", "reentrancy", "uaf"]
phying_url: "https://phying.com/item/10266"
lang: en
---

# PHP 8.5.5: var_destroy __destruct Reentrancy Heap UAF and Exploitation

## Summary

# PHP 8.5.5 — `var_destroy` `__destruct` reentrancy UAF > Sister bug to Calif.io's MAD Bugs PHP unserialize finding (2026-05-01). Independent root cause; survives the fix Calif proposes for...

## Why it matters

Demonstrates how subtle lock-free destructor reentry in complex serialization state machines can yield reliable memory corruption and RCE, even when explicit magic method dispatches are guarded.

## Intelligence Metadata

- **Sources:** github.com
- **Vendor:** PHP
- **Product:** PHP
- **Affected versions:** PHP 8.5.5 (likely 7.x - 8.5.x)
- **Published:** 2026-05-02T16:39:14Z
- **Original:** https://github.com/dinosn/php-8.5.5-var_destroy-uaf
- **Phying News:** https://phying.com/item/10266