Loading story…
A HITCON CTF exploit demonstrated how PHP's default session.upload_progress feature can be abused to place attacker-influenced data in a server-side session file and execute it through a local file inclusion (LFI) flaw. Against Ubuntu 18.04 with Apache and PHP 7.2, the technique used multipart upload progress, a timing race before session cleanup, and inclusion of the resulting session file despite the absence of remote file inclusion and a conventional session-start path.
The payload bypassed PHP's default upload-progress prefix and session-file formatting by applying chained Base64-decoding stream filters, transforming the stored session content into executable PHP. The technique illustrates the risk of PHP session-data injection when applications permit attacker-controlled file inclusion; organizations should disable unnecessary upload-progress tracking, restrict session-file access, and eliminate LFI primitives. Separately, older PHP unserialize() flaws involving SplDoublyLinkedList and __wakeup() could expose vulnerable pre-patch versions to memory disclosure or remote code execution when processing attacker-controlled serialized objects.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A public Python exploit script demonstrated the HITCON CTF 2018 One Line PHP Challenge chain by racing PHP_SESSION_UPLOAD_PROGRESS session-file writes and including the resulting session file through three Base64-decoding filters. If successful, its injected PHP payload downloads and executes a Perl script from orange.tw, demonstrating remote command execution.
HITCON CTF's One Line PHP Challenge targeted a default Ubuntu 18.04, PHP 7.2, and Apache deployment; three of 1,816 competing teams solved it. The intended chain used session upload-progress data, a race condition, local inclusion of a session file, and chained Base64-decoding PHP stream filters to achieve server-side code execution.
The disclosure and proof of concept for the PHP SplDoublyLinkedList deserialization use-after-free vulnerability were released. The flaw affected PHP releases before 5.6.13, 5.5.29, and 5.4.45.
Taoguang Chen wrote a disclosure describing a use-after-free flaw in PHP unserialize() handling of SplDoublyLinkedList objects and crafted __wakeup() methods. The issue could enable memory disclosure or potentially remote code execution when attacker-controlled serialized data is processed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
bugs.php.net
Open sourceblog.orange.tw
Open sourcegithub.com
Open sourcebugs.php.net
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how `CVE-2024-2961`, a long-standing buffer overflow in glibc's `iconv` implementation for `ISO-2022-CN-EXT`, can be exploited to achieve remote code execution in PHP applications. The technique, dubbed **CNEXT**, builds on earlier work around PHP filter chains and error-based file-read oracles, showing how `php://filter` can be abused not just to read files but to manipulate PHP heap allocations and corrupt internal memory structures. By chaining filters such as `convert.iconv`, `zlib.inflate`, and `dechunk`, the exploit can steer allocator behavior and overwrite `zend_mm_heap` hooks so that PHP ultimately invokes `system()`. The write-up says the method is reliable across PHP `7.0.0` through `8.3.7` and can be delivered in a single GET request, significantly raising the impact of otherwise limited file-read primitives. A demonstrated attack used the WordPress BuddyForms flaw `CVE-2023-26326` to gain file-read access and then escalate to code execution, while the researchers warned that the same path could affect other PHP file-read sinks, including XXE and SQL injection scenarios involving `LOAD DATA LOCAL INFILE`. The findings also revive attention on PHP filter-chain abuse first explored in prior research, showing that seemingly minor disclosure bugs can become full server compromise when combined with glibc and PHP internals.
Jun 29, 2026
A PHP web-hacking challenge demonstrated how attacker-controlled input written into a generated PHP configuration file can become executable code. The application removed double quotes, single quotes, and semicolons from a `data` parameter, but then embedded the value in a double-quoted PHP string; PHP variable-interpolation syntax could still invoke attacker-controlled functions when the generated file was requested. The technique enabled PHP code execution and inspection of runtime configuration. A broad `disable_functions` policy did not prevent disclosure of a protected `key.php` file because `gzfile` remained available, illustrating that partial PHP function blacklists and dynamically generated executable configuration files do not provide reliable isolation.
Sep 3, 2026
Three high-severity vulnerabilities have been disclosed in **MixPHP Framework** versions `2.x` through `2.2.17`, all tied to unsafe use of PHP `unserialize()` and carrying potential for remote code execution. **CVE-2026-42472** affects Redis-backed session and cache handlers that deserialize data read from Redis, while **CVE-2026-42473** impacts `FileHandler` session and cache logic that deserializes filesystem-sourced data. Both flaws are classified as `CWE-502` and were assigned `CVSS 3.1` scores reflecting network-exploitable, high-impact risk to confidentiality, integrity, and availability. A separate issue, **CVE-2026-42471**, affects the framework’s sync-invoke client, where `Connection.php` reportedly calls `unserialize()` on server responses, creating a path to client-side remote code execution if a MixPHP client connects to a malicious server. The three CVEs were published with updated descriptions, references, and severity metadata, highlighting a broader pattern of insecure deserialization across MixPHP components and exposing both server-side and client-side attack surfaces in deployments running vulnerable releases.
Jun 29, 2026