Un escáner que sigue marcando PHP2Shell tras actualizar no demuestra ejecución de código. Dinosn distingue fallos HTTP, errores fatales y crashes de una prueba real de RCE; también documenta controles negativos en 8.5.12. #ciberseguridad #PHP dinosn/php-cve-2026-10961x-lab-poc
1 like · 96 views
Dinosn reporta tres vías de impacto que persisten en PHP 8.5.12: UAF en deserialización, mezcla de serializadores e inyección en sesiones. Tienen requisitos propios; no prueban un bypass remoto universal de PHP2Shell. #ciberseguridad #PHP dinosn/php-cve-2026-10961x-lab-poc
1 like · 124 views
#PHP2shell is the Octoberfest for security researchers and the hottest topic right now.
wiz.io
dinosn/php-cve-2026-10961x-lab-poc
php2shell.evilbit.de
1 like
Hay lab para reproducir PHP2Shell (CVE-2026-109618/109619) por @Dinosn . Para gente de AppSec o DevSecOps.
Revísenlo en una VM o sandbox aislada.
No es llegar y meter las manos, vibecoders 👀
dinosn/php-cve-2026-10961x-lab-poc
2 likes · 1 repost · 261 views
Adding this to the lab, github.com/dinosn/php-cve-2026-10961x-lab-poc/blo… , this will work on stock, official php:8.4.26-apache image, no php.ini change, single-worker
prefork, display_errors=Off . Default has the 128M allocation, not the 8M that is on labs. All work in progress. I don't see realistic scenario though without spamming heavily and for long time servers.
35 likes · 5 reposts · 3,435 views
CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window
Leak hit HN 2026-10-20 15:20Z. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 fix both CVEs.
Mechanism: php_request_startup() calls php_hash_environment() (multipart parse, the session.upload_progress callback, php_session_initialize() on the process-wide BG(serialize)/BG(unserialize)) one line before zend_activate_modules() runs basic's RINIT, which is what zeroes them.
CVE-2026-109618 is the exit direction: an OOM longjmp out of the serializer leaves partial state and mod_php runs shutdown anyway.
CVE-2026-109619 is the entry direction: the next request on the same worker dereferences that state before RINIT.
The 8.5.12 patch adds php_basic_early_rinit(), a PS(in_rfc1867_update) flag that forces incomplete_classes_only inside the window, and removes zend_bailout() from the OOM path. The ordering is unchanged.
The post_bytes_processed UAF theory behind most of the 70+ GitHub repos does not fire: the cached array's refcount walks 2 to 1 and never reaches 0 on instrumented 8.2.34 through 8.5.12 (xuehuolll audit, dinosn lab). Three paths survive 8.5.12: the var_destroy re-entry UAF, the serialize_handler mismatch, and upload-progress session injection.
Labs: dinosn/php-cve-2026-10961x-lab-poc and xuehuolll/php2shell-CVE-2026-109618-109619
Releasing my lab as well PHP RCE dinosn/php-cve-2026-10961x-lab-poc , use it as a guidance and further reference for work upon. Patches are available at this moment PATCH! t.co
94 likes · 17 reposts · 9,032 views
Mentions
Un escáner que sigue marcando PHP2Shell tras actualizar no demuestra ejecución de código. Dinosn distingue fallos HTTP, errores fatales y crashes de una prueba real de RCE; también documenta controles negativos en 8.5.12. #ciberseguridad #PHP dinosn/php-cve-2026-10961x-lab-poc
Dinosn reporta tres vías de impacto que persisten en PHP 8.5.12: UAF en deserialización, mezcla de serializadores e inyección en sesiones. Tienen requisitos propios; no prueban un bypass remoto universal de PHP2Shell. #ciberseguridad #PHP dinosn/php-cve-2026-10961x-lab-poc
#PHP2shell is the Octoberfest for security researchers and the hottest topic right now. wiz.io dinosn/php-cve-2026-10961x-lab-poc php2shell.evilbit.de
Hay lab para reproducir PHP2Shell (CVE-2026-109618/109619) por @Dinosn . Para gente de AppSec o DevSecOps. Revísenlo en una VM o sandbox aislada. No es llegar y meter las manos, vibecoders 👀 dinosn/php-cve-2026-10961x-lab-poc
Adding this to the lab, github.com/dinosn/php-cve-2026-10961x-lab-poc/blo… , this will work on stock, official php:8.4.26-apache image, no php.ini change, single-worker prefork, display_errors=Off . Default has the 128M allocation, not the 8M that is on labs. All work in progress. I don't see realistic scenario though without spamming heavily and for long time servers.
CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window Leak hit HN 2026-10-20 15:20Z. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 fix both CVEs. Mechanism: php_request_startup() calls php_hash_environment() (multipart parse, the session.upload_progress callback, php_session_initialize() on the process-wide BG(serialize)/BG(unserialize)) one line before zend_activate_modules() runs basic's RINIT, which is what zeroes them. CVE-2026-109618 is the exit direction: an OOM longjmp out of the serializer leaves partial state and mod_php runs shutdown anyway. CVE-2026-109619 is the entry direction: the next request on the same worker dereferences that state before RINIT. The 8.5.12 patch adds php_basic_early_rinit(), a PS(in_rfc1867_update) flag that forces incomplete_classes_only inside the window, and removes zend_bailout() from the OOM path. The ordering is unchanged. The post_bytes_processed UAF theory behind most of the 70+ GitHub repos does not fire: the cached array's refcount walks 2 to 1 and never reaches 0 on instrumented 8.2.34 through 8.5.12 (xuehuolll audit, dinosn lab). Three paths survive 8.5.12: the var_destroy re-entry UAF, the serialize_handler mismatch, and upload-progress session injection. Labs: dinosn/php-cve-2026-10961x-lab-poc and xuehuolll/php2shell-CVE-2026-109618-109619
Releasing my lab as well PHP RCE dinosn/php-cve-2026-10961x-lab-poc , use it as a guidance and further reference for work upon. Patches are available at this moment PATCH! t.co