WordPress pingback and Brotli RCE

Researchers investigated a remote code execution reproduction involving WordPress pingbacks and an out-of-bounds write in the native Brotli decoder. During an XML-RPC pingback fetch, a crafted Brotli response triggered a decoding error, causing Requests to retry with decoding disabled. An attacker-controlled header name processed during this retry overwrote part of PHP's strtolower internal-function handler pointer to execute system commands. Open article →