Loading story…
A PHP web-hacking challenge demonstrated how attacker-controlled input written into a generated PHP configuration file can become executable code. The application removed double quotes, single quotes, and semicolons from a data parameter, but then embedded the value in a double-quoted PHP string; PHP variable-interpolation syntax could still invoke attacker-controlled functions when the generated file was requested.
The technique enabled PHP code execution and inspection of runtime configuration. A broad disable_functions policy did not prevent disclosure of a protected key.php file because gzfile remained available, illustrating that partial PHP function blacklists and dynamically generated executable configuration files do not provide reliable isolation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The demonstrated exploit used phpinfo() to inspect restrictions, then called gzfile—absent from the disable_functions list—to read ../key.php and obtain the protected challenge key.
A PHP web-hacking challenge accepted attacker-controlled GET parameters and wrote the data value into a generated PHP configuration file. Despite filtering quotes and semicolons, PHP double-quoted string interpolation allowed attackers to execute PHP code when the generated file was accessed.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
kingkk.com
Open sourceicheernoom.blogspot.tw
Open sourceblog.orange.tw
Open sourcewonderkun.cc
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A HITCON CTF exploit demonstrated how PHP's default `session.upload_progress` feature can be abused to place attacker-influenced data in a server-side session file and execute it through a local file inclusion (LFI) flaw. Against Ubuntu 18.04 with Apache and PHP 7.2, the technique used multipart upload progress, a timing race before session cleanup, and inclusion of the resulting session file despite the absence of remote file inclusion and a conventional session-start path. The payload bypassed PHP's default upload-progress prefix and session-file formatting by applying chained Base64-decoding stream filters, transforming the stored session content into executable PHP. The technique illustrates the risk of PHP session-data injection when applications permit attacker-controlled file inclusion; organizations should disable unnecessary upload-progress tracking, restrict session-file access, and eliminate LFI primitives. Separately, older PHP `unserialize()` flaws involving `SplDoublyLinkedList` and `__wakeup()` could expose vulnerable pre-patch versions to memory disclosure or remote code execution when processing attacker-controlled serialized objects.
Sep 3, 2026
Researchers detailed how `CVE-2024-2961`, a long-standing buffer overflow in glibc's `iconv` implementation for `ISO-2022-CN-EXT`, can be exploited to achieve remote code execution in PHP applications. The technique, dubbed **CNEXT**, builds on earlier work around PHP filter chains and error-based file-read oracles, showing how `php://filter` can be abused not just to read files but to manipulate PHP heap allocations and corrupt internal memory structures. By chaining filters such as `convert.iconv`, `zlib.inflate`, and `dechunk`, the exploit can steer allocator behavior and overwrite `zend_mm_heap` hooks so that PHP ultimately invokes `system()`. The write-up says the method is reliable across PHP `7.0.0` through `8.3.7` and can be delivered in a single GET request, significantly raising the impact of otherwise limited file-read primitives. A demonstrated attack used the WordPress BuddyForms flaw `CVE-2023-26326` to gain file-read access and then escalate to code execution, while the researchers warned that the same path could affect other PHP file-read sinks, including XXE and SQL injection scenarios involving `LOAD DATA LOCAL INFILE`. The findings also revive attention on PHP filter-chain abuse first explored in prior research, showing that seemingly minor disclosure bugs can become full server compromise when combined with glibc and PHP internals.
Jun 29, 2026
Attackers concealed a PHP web shell inside whitespace appended to a seemingly benign `license.php` file, using a steganographic technique that encoded the payload in tabs and spaces after legitimate-looking text from the GNU GPL license. The visible PHP code then read its own file, extracted data after the final semicolon, converted whitespace into binary, and applied multiple decoding layers including `gzdecode`, `str_rot13`, and `base64_decode` to rebuild and execute the hidden malware. The recovered payload was a large web shell capable of file and database operations, information theft, file infection, brute-force activity, and use as a server console or anonymizer on compromised websites. Investigators also found uploader backdoors used to create the fake `license.php` files and additional malicious changes to `.htaccess` and `index.php`, while noting that the whitespace-decoding routine appeared to be adapted from a public proof of concept previously published on Habr.ru.
Aug 14, 2026