Remote Code Execution Exploit for PHP 8.4.26 Disclosed

• •The PoC exploits memory exhaustion in Alpine PHP 8.4.26 to achieve remote code execution.
• •Successful exploitation allows attackers to execute arbitrary commands on vulnerable servers.
• •The exploit requires specific server configurations and memory layouts to function correctly.

Security researcher KillaBoi released a proof-of-concept (PoC) script, stealmybitcoin_poc.py, that exploits a vulnerability in Alpine PHP 8.4.26. The exploit targets memory exhaustion through multipart uploads, allowing attackers to recover sensitive memory addresses and execute arbitrary commands via PHP's zif_system function. The PoC script is designed to work with a specific server configuration and requires precise memory layout knowledge. It has been confirmed to successfully execute commands, including printing a nonce and the SHA-256 hash of a binary. The exploit is particularly relevant for systems running Alpine PHP 8.4.26 CLI servers behind nginx. The release of this PoC raises concerns about potential exploitation in the wild, although no has been confirmed yet. The vulnerability is significant due to the ease of execution and the specific conditions required for the exploit to succeed.