PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318

bishopfox.com | vulnerability | High | Actively exploited | CVE-2026-28318 | #active-exploitation | #rce | #vulnerability-research | #denial-of-service | #solarwinds | #serv-u | #cve-2026-28318 | #heap-corruption
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox confirms CVE-2026-28318: one unauthenticated POST with a deflate Content-Encoding crashes SolarWinds Serv-U via heap corruption, but three probed RCE paths dead-end; HF1 fixes it.
CVE
CVE-2026-28318
CVSS
7.5
Published
Collected

Related coverage

research · aretiq.ai
CVE-2026-28318 — SolarWinds Serv-U HTTP Deflate Uncontrolled Resource Consumption
SolarWinds Serv-U's HTTP deflate handler decompresses small POST bodies into gigabytes of memory, crashing the service without authentication. Fixed in 15.5.4 Hotfix 1 and listed in CISA's KEV.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
advisory · bishopfox.com
SolarWinds Serv-U Managed File Transfer – Denial of Service
Denial of service in SolarWinds Serv-U 15.1.6.25: an authenticated user swaps Login.xml for a crafted value to trigger a NULL pointer dereference and crash the server (CVE-2018-10241).
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
Back