PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

From opcode to code: how AI chatbots can help with decompilation

swarm.ptsecurity.com | research | #ai-security | #php | #reverse-engineering | #decompilation | #zend-engine | #opcode
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Commercial PHP encoders serialize Zend VM opcodes; the author built a tool to extract and disassemble them, then used AI chatbots to help reconstruct readable source for vulnerability research.
Published
Collected

Related coverage

research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
tool · github.com
Apple Private Cloud Compute (PCC) Security Source Code and Research Tools
Provides unprecedented source-level visibility into Apple's cloud AI infrastructure, allowing security researchers to verify cryptographic privacy guarantees and audit components eligible for Apple's PCC Security Bounty.
research · projectblack.io
FileFlows Vulnerabilities - SQL Injection by Decompiling .NET Code
Decompiling FileFlows' .NET binaries uncovered a SQL injection in the library-file search endpoint; simple quote replacement was insufficient to stop it on some supported databases.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
Back