The Race to Exploit a Critical PHP Vulnerability
· 12:48 · Watch on YouTube ↗
Summary
A researcher describes using Codex to investigate a newly announced critical PHP RCE and reproduce a one-byte heap use-after-free in a lab. The proof of concept was incomplete, and the video urges PHP site operators to update.
Key points
- The video discusses a newly announced critical remote code execution vulnerability in PHP and says a patch was forthcoming.
- The narrator used Codex to inspect PHP source history and investigate network-reachable code related to mod_php, SAPI, and file uploads.
- The narrator reports reproducing a one-byte heap use-after-free with AddressSanitizer after a multipart parsing memory-limit bailout, followed by cleanup on a later request handled by the same prefork worker.
- The narrator's proof of concept relied on reading process memory from the container to obtain addresses, so it was incomplete against a target using ASLR.
- Kabeer sent an exploit with an address leak; the narrator says it could leak data through an error response and required server errors to be enabled.
- The video cautions that some circulated exploit explanations were incorrect or did not match the reported vulnerability, and recommends updating PHP.
Article Details
- Topics
- [00:05] Newly announced PHP RCE and the race to develop an exploit
- [00:51] Evaluating inaccurate or mismatched exploit claims
- [02:25] AI-assisted investigation using PHP source history
- [06:23] Searching network-reachable PHP code and developing a proof of concept
- [08:15] Testing and rejecting a circulated exploit explanation
- [09:30] Multipart parsing and upload-progress use-after-free discovery
- [10:30] Proof-of-concept limitations and an address-leak exploit
- [11:30] Exploitation implications and advice to update PHP