PHP2Shell : When a Failed Request Becomes Code Execution

The PHP project issued emergency security updates for two vulnerabilities collectively known as PHP2Shell, which enable unauthenticated remote code execution and memory disclosure. Researchers demonstrated that interrupted initialization, OOM errors, and stale worker state can expose incomplete objects or lingering references when PHP workers handle multiple requests. The author argues that proper remediation requires updating the underlying PHP runtime on servers rather than relying solely on application patches or framework protections. Open article →