PHP2Shell heap exploitation leads to RCE in PHP
Original title: PHP2Shell — Deep Dive
Author shares step-by-step research on PHP2Shell UAF chain using OOM and session handling for remote code execution.
This research provides a detailed walkthrough of PHP2Shell, a vulnerability in PHP's Zend engine triggered by OOM during session cookie handling. The attack creates a stale pointer, uses heap grooming to forge structures, and leverages code and heap leaks to achieve pDestructor hijacking for RCE. The author explains memory allocation, leak calibration, and the full four-stage pipeline while noting their own technical basis and potential for further discussion.
Unconfirmed: Author's interpretation of internal PHP behavior may contain inaccuracies or require verification.
- Stale pointer arises from PHP session handling combined with OOM.
- Heap grooming positions forged zend_string structs for UAF.
- Code pointer leak bypasses ASLR via fingerprinting.
- Reusing allocator to forge HashTable for pDestructor hijack.
- Command output trick locates socket in /proc for RCE.
- Vendors
- php
From the original article
14 min read at djad04.github.ioI started writing this research on October 26, 2026, and I'm not entirely sure when I'll finish it. At the time of writing, there is still very little information available about PHP2Shell, particularly when it comes to detailed technical analysis of the vulnerabilities and the exploitation process.
By djad04.github.io via hoistbypetard · djad04.github.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.