Back Sploitus Exploit for Improperly Controlled Sequential Memory Allocation in Php
[ · [**How It Works**](#-how-it-works) · [**Screenshots**](#-screenshots) · [**Documentation**](#-documentation)
PHP2Shell is a **security research toolkit** for critical PHP vulnerabilities. These bugs allow attackers to:
- ✅ **Run commands** on any PHP server (Remote Code Execution)
- ✅ **Read server memory** like passwords and tokens (Memory Disclosure)
- ✅ **No login needed** — works without any authentication
- ✅ **No file upload needed** — just send a simple HTTP request
> ⚠️ **Impact:** 30% of all PHP websites use `mod_php` and are vulnerable. This includes WordPress, Drupal, and Joomla.
[Wiz Research]( discovered these bugs in October 2026. This repository has **independently verified** proof-of-concept exploits.
| **Bug 1** | Run any command on the server | 🔴 Critical |
| **Bug 2** | Read passwords from server memory | 🔴 Critical |
| **Bug 3** | Use-After-Free memory bug | 🟠 High |
| **Bug 4** | OPcache memory corruption | 🔴 Critical |
| 8.4.0 – 8.4.26 | 🔴 **Vulnerable** | Update to 8.4.27 |
| 8.3.0 – 8.3.35 | 🔴 **Vulnerable** | Update to 8.3.36 |
| 8.2.0 – 8.2.34 | 🔴 **Vulnerable** | Update to 8.2.35 |
| 8.5.0 – 8.5.11 | 🔴 **Vulnerable** | Update to 8.5.12 |
| 8.1.x and older | 🔴 **Vulnerable** | No fix (end of life) |
git clone
The lab runs WordPress, Drupal, and Joomla with vulnerable PHP:
Wait 30 seconds for the containers to start. Then you have:
🎉 **Success!** You ran a command on the server without any login.
| **php2shell_exploit.py** | Remote code execution | `python3 exploit/php2shell_exploit.py -u URL --shell` |
| **memdisclosure.py** | Read server memory | `python3 exploit/memdisclosure.py -u URL --analyze` |
| **scanner.py** | Find vulnerable servers | `python3 tools/scanner.py -u URL` |
| **shell_server.py** | Catch reverse shells | `python3 tools/shell_server.py --lhost IP` |
| **bug3_backtrace_uaf.py** | Test Bug 3 | `python3 exploit/bug3_backtrace_uaf.py --host IP` |
| **bug4_opcache_confusion.py** | Test Bug 4 | `python3 exploit/bug4_opcache_confusion.py --host IP` |
python3 tools/shell_server.py --lhost YOUR_IP --lport 4444
python3 tools/scanner.py -u
python3 tools/scanner.py -t targets.txt -o results.csv
### Memory Disclosure — 4096 Bytes Leaked
### The Attack Chain (Simple Explanation)
1. Attacker sends a special HTTP POST request
2. PHP starts processing but runs out of memory (OOM)
3. PHP crashes but leaves memory pointers behind
4. Attacker sends another request to the SAME worker
5. The old pointers now point to attacker's data
6. PHP follows the pointers and runs attacker's command
- **mod_php** keeps the same process for many requests
- When PHP crashes, it doesn't clean up properly
- The request can use the old (bad) memory
- **PHP-FPM** is safe because each request gets a new process
- [TECHNICAL.md](docs/TECHNICAL.md) — Deep dive into the bugs
- [WIZ_REPRODUCTION.md](docs/WIZ_REPRODUCTION.md) — Step-by-step reproduction guide
PHP-FPM is not vulnerable to this attack:
├── exploit/ # Attack tools
│ ├── php2shell_exploit.py # Main RCE exploit
│ ├── memdisclosure.py # Memory leak tool
│ ├── bug3_backtrace_uaf.py # Bug 3 tester
│ └── bug4_opcache_confusion.py # Bug 4 exploit
├── tools/ # Helper tools
│ ├── scanner.py # Find vulnerable servers
│ ├── shell_server.py # Reverse shell listener
│ └── calibrate_offsets.py # Offset calculator
├── lab/ # Test environment
│ └── docker-compose.yml # WordPress + Drupal + Joomla
├── docs/ # Documentation
│ ├── TECHNICAL.md # Technical details
│ └── WIZ_REPRODUCTION.md # Reproduction guide
├── evidence/ # Proof files
│ └── *.txt # Test outputs
└── tests/ # Unit tests
| [TECHNICAL.md](docs/TECHNICAL.md) | Deep technical analysis of all 4 bugs |
| [WIZ_REPRODUCTION.md](docs/WIZ_REPRODUCTION.md) | How to reproduce the Wiz research |
| [PATCHED_VS_UNPATCHED.md](docs/PATCHED_VS_UNPATCHED.md) | Comparison of fixed vs vulnerable versions |
| [SECURITY.md](SECURITY.md) | Security policy |
| Wiz Research Blog | [PHP2Shell: Chaining 4 Bugs for PHP RCE]( |
| CVE-2026-109618 | [NVD Entry]( |
| CVE-2026-109619 | [NVD Entry]( |
| PHP Security | [PHP Security Advisory]( |
- **Wiz Research** — Original discovery and responsible disclosure
- **[@memuratozturk]( — Independent verification, exploit development, testing
This tool is for AUTHORIZED SECURITY TESTING and EDUCATION only.
Using this tool against systems without permission is ILLEGAL.
You are responsible for following all local laws.
The developers are not responsible for any misuse.
`php` `security` `exploit` `cve` `rce` `remote-code-execution` `memory-disclosure` `vulnerability` `penetration-testing` `security-research` `wordpress` `drupal` `joomla` `apache` `mod-php` `proof-of-concept` `ctf` `bugbounty` `infosec` `cybersecurity`
### ⭐ Star this repo if it helped your research!
**Made by [@memuratozturk](
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
