PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hack the Elephant One Bite at a Time: JPEG-Related Memory-Safety Bugs in PHP

swarm.ptsecurity.com | research | #vulnerability-research | #memory-safety | #php | #heap-overflow | #jpeg | #getimagesize | #iptcembed
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PT SWARM audited PHP's ext/standard C code and found memory-safety bugs: a heap memory disclosure in getimagesize() and a heap buffer overflow in iptcembed(), both reachable via crafted JPEGs.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
research · swarm.ptsecurity.com
Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql
Positive Technologies details two PHP PDO flaws: CVE-2025-14179, SQL injection in pdo_firebird via NUL bytes in quoted strings, and CVE-2025-14180, a NULL pointer dereference in PDO quoting.
research · swarm.ptsecurity.com
Attack arithmetic: how an integer overflow in PostgreSQL libpq leads to denial of service
An integer overflow in PostgreSQL libpq's PQescapeInternal() makes it allocate too little and write hundreds of MB past the buffer, segfaulting applications — a denial-of-service vulnerability.
Back