Calif Research shows pre-auth PHP2Shell RCE on default PHP
Original title: php2shell by Calif Research
The authors say paths dating to PHP 5.4.0 yield RCE, including on WordPress, Drupal, and Joomla.
Calif Research published a PHP2Shell analysis saying PHP can leave stale state when an allocation exceeds memory_limit or a fatal error interrupts cleanup, leading to memory leaks and remote code execution. They report confirmed pre-authentication RCE against named versions of WordPress, Drupal, Joomla, and several other PHP applications, plus arbitrary scripts in some cases. They say Apache mod_php on PHP 7.3 and later is exploitable under default configurations, while PHP-FPM takes a process-exit path that avoids the same table teardown.
Unconfirmed: Affected application versions and exploitability are the researchers’ claims; this post does not name patched releases.
- Named targets include WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, and MediaWiki 1.46.2.
- Also listed: Roundcube 1.7.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1, and WHMCS.
- The post says exploitation depends on PHP version and SAPI but works under default configurations.
- A demo video is linked; no fixed PHP version is stated in the post.
Impact: Pre-authentication remote code execution under default PHP configurations
| Product | Affected |
|---|---|
| PHP | PHP >= 5.4.0; mod_php RCE on PHP >= 7.3 |
| WordPress | 7.1.2 |
| Drupal | 11.4.3 |
| Joomla | 6.1.4 |
| MediaWiki | 1.46.2 |
| Roundcube | 1.7.4 |
| Magento | 2.4.9 |
| phpMyAdmin | 5.2.3 |
| Nextcloud | 35.0.1 |
| Laravel | 13.11 |
- 1.Treat Apache mod_php with default limits as exposed until a vendor fix is confirmed.
- Vendors
- PHP
- Organizations
- Calif Research
From the original article
13 min read at calif.io
PHP can leave dangling pointers/state when an allocation would exceed memory_limit, or another fatal error interrupts native code before its normal cleanup completes. Request shutdown may then free memory that surviving state still references.
By calif.io via refi64 · calif.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.