SANS analyst: "php2shell" exploits are far from one-click reliable
Bojan Zdrnja walks through the published proofs of concept and finds heavy preconditions, including a small memory limit and a single-worker setup, that real servers rarely match.
Writing for the SANS Internet Storm Center, Bojan Zdrnja looked at the proofs of concept circulating for the "php2shell" PHP vulnerability and concluded that a universal, reliable, one-click exploit is quite difficult to build. He also noted that a large share of the published material appears to be AI-generated and low quality.
His main objection is that the working demos depend on conditions real servers rarely meet. One PoC sends a POST request with many small fields, sets up a session and upload progress, then appends a large field so that PHP's memory allocation fails. That only works because the demo sets the memory limit to 8 MB, while production setups usually allow far more. The demo also runs a single-worker prefork configuration, which guarantees the next stage lands on the same worker. With multiple workers, an attacker would have to exhaust them and catch the one that frees up.
Later stages leak heap and library addresses to defeat ASLR, but the published code reads the needed offsets straight from the server's library, which Zdrnja calls cheating. A real attacker would have to know those offsets for each build and distribution.
His recommendation: set session.upload_progress.enabled to 0, especially since a bypass of the currently available fix reportedly exists.
Sources
- (Reliable)? php2shell exploitability, (Fri, Oct 23rd)Primaryisc.sans.edu
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning