88
There isn't an easy exploit for this PHP vulnerability
(eliastaylor.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 22 Oct 2026
88 points (88.6% liked)
Selfhosted
63189 readers
465 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
From the very little I've researched, a DoS with it isn't hard but for RCE one needs to know some pointers inside... doable if you assume it's Debian or something then just download a bunch of versions locally and try them. This also implies that most hardened distributions are all unaffected (because relocations) and source builds are effectively unaffected unless the binary is dumped somehow.
Yes, and even for Debian because of ASLR, but these vulnerabilities may allow memory to be leaked and from those memory leaks an attacker can reconstruct the necessary information. That's obviously not something just anybody could have done, but publicly available AI tools have made this level of attack complexity much more accessible. In https://www.youtube.com/watch?v=7CiZmq2llDg&t=629s they first find the vulnerability but their AI cheated to make it exploitable and then somebody else gives them a way to leak memory to figure out where things are in memory. I don't think having errors enabled is actually necessary for the exploit to work, because if that was the case the PHP security announcement would have said "turn off errors" instead of "turn off your server now."
blind rop? Well, if they are using AI they are unlikely to do this in a reasonable amount of time anyway. Also, not sure how one would go on with that if all protectors and pointers change every run and fork like on OpenBSD.