r/programming • u/sagitz_ • 7d ago

PHP2Shell: Critical vulnerabilities in the backbone of the web

https://php2shell.com
516 Upvotes

95% Upvoted

70 comments sorted by

46

u/gajus0 6d ago

Does anyone have a high-level walkthrough of how this attack works?

99

u/throwaway490215 6d ago

Send a request too big to fit. PHP starts building a table and increments the item count before filling each slot. The allocation fails, PHP bails out of the request — but the count now includes a slot that was never written.

Cleanup trusts the count and walks into that empty slot. The bytes there aren't a real object — they're attacker-planted garbage (freed memory reused from an earlier request or earlier in the same request). PHP reads them as a pointer + type and does its normal "free/destroy whatever this points at."

So the attacker gets "do a write at an address I choose." They aim that at a function pointer, overwrite it, and the next normal call jumps to attacker code.

25

u/tripleplay23 6d ago

This seems like a plausible description, but as described it sounds like it would immediately crash (at next cleanup) any PHP server after any “too big” request. I assume there is more nuance here?

→ More replies (2)

175

u/currentscurrents 6d ago

Details from the group that found the exploit: https://www.wiz.io/blog/php2shell-php-rce

They credit their discovery to AI tools, especially Gemini 4 .

168

u/MorrisonLevi 6d ago

As far as I understand it, the core of the vulnerability was known in 2024, long before these AI tools were able to do this kind of stuff. It was just difficult to fix and nobody had figured out how to actually exploit it, so other things took priority. See the PHP Foundation's blog article on today's security release.

Now AI tools have radically accelerated how to connect the dots from "theoretically bad" to "mother forking shirtballs bad."

67

u/PascalsBadger 6d ago

As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.

Oof

5

u/teodorlojewski 6d ago

Thanks for the insight!

17

u/tyler1128 6d ago

They also seem to have written the article largely using AI.

17

u/currentscurrents 6d ago

Seems to be more and more common these days. 

I think the correctness of AI prose has made large strides, but the readability leaves much to be desired.

→ More replies (5)

6

u/teodorlojewski 6d ago

'PHP is the programming language behind much of the web, powering WordPress, Drupal and MediaWiki, the software that runs Wikipedia. A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure.'

What came first, the patch for the wiki or the wiki for the patch?

32

u/unicodemonkey 6d ago

Let's make paragraphs pop into existence with a significant delay and with random animation effects as you scroll the page, it'll help readability for sure.

112

u/hazpotts 6d ago

Anyone blaming people for using PHP mustn't remember HeartBleed or Shellshock. This vulnerability has no baring on any fundamental flaw in PHP itself. It's pervasiveness is just down to it's wide use, like OpenSSL and Bash in these previous exploits.

→ More replies (7)

5

u/thedogz11 5d ago

Meanwhile we get npm supply chain exploits so often it's not even news anymore.

PHP, you been a good pony.

16

u/Primary_Ads 6d ago

thank the heavens im not using php

21

u/peaky_blin 6d ago

Even if you’re not, a service you’re relying upon might be using it, tbh it’s a shitty situation for the whole world

2

u/burgonies 6d ago

My wife’s job apparently uses some service that runs on PHP. It was down all day.

47

u/labatteg 6d ago

- Thank the heavens I'm not using PHP!

- Exactly! What if you were hit by this exploit?

- What exploit?

4

u/matthieuC 5d ago

Tell us what you use and I bet that within one hour you'll have 5 people telling you this is the worst thing that ever happened since butt cancer.

→ More replies (3)