PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Finding and Exploiting a 21-Year-Old Vulnerability in PHP

calif.io | research | #vulnerability-research | #php | #exploitation | #code-audit | #madbugs | #legacy-vulnerability
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# Finding and Exploiting a 21-Year-Old Vulnerability in PHP When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior. Ryan A. May 1, 2026 phpmadbugs Contents...
Published
Collected

Related coverage

research · calif.io
An AI audit of FreeBSD
# An AI audit of FreeBSD 15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape. Ryan A. May 28, 2026 freebsdmadbugs Contents 1. What we want to achieve 2. How we work 3. Warez 4. Thanks...
research · calif.io
We Asked Claude to Audit Sagredo's qmail. It found a RCE.
One prompt, 101 minutes, and a working exploit against a widely deployed qmail fork.
research · calif.io
Claude Found an Auth Bypass in NSA's Ghidra Server
This bug may resemble a backdoor in effect, but there’s no evidence it was intentional. Really.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
Back