Loading story…
Researchers detailed how CVE-2024-2961, a long-standing buffer overflow in glibc's iconv implementation for ISO-2022-CN-EXT, can be exploited to achieve remote code execution in PHP applications. The technique, dubbed CNEXT, builds on earlier work around PHP filter chains and error-based file-read oracles, showing how php://filter can be abused not just to read files but to manipulate PHP heap allocations and corrupt internal memory structures. By chaining filters such as convert.iconv, zlib.inflate, and dechunk, the exploit can steer allocator behavior and overwrite zend_mm_heap hooks so that PHP ultimately invokes system().
The write-up says the method is reliable across PHP 7.0.0 through 8.3.7 and can be delivered in a single GET request, significantly raising the impact of otherwise limited file-read primitives. A demonstrated attack used the WordPress BuddyForms flaw CVE-2023-26326 to gain file-read access and then escalate to code execution, while the researchers warned that the same path could affect other PHP file-read sinks, including XXE and SQL injection scenarios involving LOAD DATA LOCAL INFILE. The findings also revive attention on PHP filter-chain abuse first explored in prior research, showing that seemingly minor disclosure bugs can become full server compromise when combined with glibc and PHP internals.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Lexfo published part 1 of its CNEXT research on exploiting CVE-2024-2961, a long-standing buffer overflow in glibc's iconv implementation for ISO-2022-CN-EXT conversions. The write-up showed how PHP's php://filter behavior and heap manipulation can turn a file-read primitive into reliable remote code execution across PHP 7.0.0 through 8.3.7.
A vulnerability in the WordPress BuddyForms plugin, tracked as CVE-2023-26326, was disclosed and later used as an example file-read primitive for PHP exploitation. In the referenced material, it serves as the initial access point before escalation to code execution.
Synacktiv published research describing PHP filter chains that enable file reads via an error-based oracle. This established a practical file-read primitive in PHP applications that later exploitation work could build on.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PHP has patched two memory-safety vulnerabilities in its `ext/standard` image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as **CVE-2025-14177**, affects `getimagesize` and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as `APP1`. A second flaw in `iptcembed` can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single `fstat()` result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check. The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for `getimagesize`, as well as a FIFO-based overflow scenario for `iptcembed`. PHP addressed the flaws by correcting chunk-buffer pointer handling in `php_read_stream_all_chunks` and adding boundary checks and safer error handling for `iptcembed`; fixes were released in **PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1**. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Jun 29, 2026
A critical remote code execution vulnerability in PHP on Windows, tracked as **`CVE-2024-4577`**, allows argument injection in **PHP-CGI** through Windows Best-Fit character encoding conversion. The flaw affects supported and unsupported PHP 5.x+ versions and is especially dangerous in CGI deployments where `php-cgi.exe` or `php.exe` is exposed to the web, including common default **XAMPP**-style configurations. Researchers reported that specially crafted HTTP requests can bypass prior protections and achieve remote code execution without authentication. Security updates were released in **PHP 8.3.8, 8.2.20, and 8.1.29**, but exploitation began rapidly after disclosure. Multiple reports said attackers were using crafted POST requests to launch `mshta.exe`, retrieve a malicious HTA payload, and execute **TellYouThePass** ransomware via in-memory VBScript loading. Defenders were urged to patch immediately and, where patching was not yet possible, restrict or disable PHP-CGI exposure and apply web-server filtering and configuration mitigations to block exploit requests.
Jul 24, 2026
A public advisory disclosed **CVE-2026-29014**, an unauthenticated PHP code injection vulnerability in **MetInfo CMS** versions **7.9, 8.0, and 8.1**. The flaw affects `weixinreply.class.php`, specifically the `weixinreply::wxAdminLogin()` method, where attacker-controlled `EventKey` and `FromUserName` XML fields are insufficiently sanitized before being passed to cache handling functions. The issue allows path traversal and arbitrary cache file inclusion, enabling attackers to write malicious PHP into `/cache/weixin/Array.php` and achieve remote code execution. The vulnerability was discovered by **Egidio Romano** and was publicly disclosed after the vendor reportedly did not respond to multiple contact attempts. Exploitation on non-Windows systems requires the `/cache/weixin/` directory to exist, a condition typically met when the official **WeChat plugin** is installed and configured. One advisory said no official patch was available at disclosure, while a later vendor update indicated a fix was released on **2026-04-07**.
Jun 29, 2026