Loading vulnerability…
CVE-2025-14178 is an integer-overflow-driven heap buffer overflow in PHP's array_merge() function. In PHP 8.1 before 8.1.34, 8.2 before 8.2.30, 8.3 before 8.3.29, 8.4 before 8.4.16, and 8.5 before 8.5.1, precomputation of packed-array element counts using zend_hash_num_elements() can overflow when the aggregate count exceeds 32-bit limits or HT_MAX_SIZE. The resulting undersized allocation can lead to a heap buffer overflow.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a standalone Bash-based exploit toolkit centered on PHP8.1.x_Exploit.sh, which orchestrates detection and exploitation of four PHP CVEs using modular helper scripts under modules/. The main script normalizes target URLs, fingerprints OS and PHP version via HTTP headers and a phpinfo.php probe, crawls homepage links/forms, enumerates likely CGI and upload endpoints, and then invokes per-CVE modules. The repository structure is simple: one main driver script, four CVE-specific Bash modules, one shared utils module, and a README. Primary exploit capability is CVE-2024-4577 against Windows PHP-CGI. The module tests two query-string injection variants, including a soft-hyphen bypass, by setting allow_url_include and auto_prepend_file=php://input and POSTing PHP code. On success it either demonstrates command execution with whoami or launches a PowerShell reverse shell to an operator-supplied IP/port. This is a real exploitation path providing RCE. A second remote capability targets CVE-2025-14177 by generating malformed JPEG files and POSTing them to discovered upload endpoints using multipart form field file. Detection looks for a marker string or long printable output in responses; exploitation repeats the upload 10 times and stores raw responses and extracted strings under a reports subdirectory, aiming to capture leaked heap data. The remaining two modules, CVE-2025-14180 and CVE-2025-14178, are effectively local/RCE-follow-on checks and crash payloads rather than pure remote exploits. Both use php -r locally when PHP CLI is present; the exploit functions POST PHP snippets to a target URL if remote code execution is already available. CVE-2025-14180 attempts to trigger a PDO PostgreSQL null dereference using DSN pgsql:host=localhost;dbname=postgres with emulated prepares enabled. CVE-2025-14178 attempts an array_merge integer overflow by allocating extremely large arrays. Both are described as potentially crashing or destabilizing the PHP process. Overall, this is an operational multi-CVE web exploitation script, not just a detector. It supports single-target and batch modes, optional GNU parallel execution, report logging, and automatic exploitation unless scan-only is specified. Fingerprintable targets include common CGI paths, common upload paths, phpinfo.php probing, php://input injection, localhost PostgreSQL access, and attacker-defined reverse-shell callback endpoints.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A heap-based buffer overflow in PHP's array_merge() function.
An Important-severity remotely reachable vulnerability affecting an unspecified package covered by the TuxCare CentOS 8.4 CLSA-2026-1769164237 security advisory. The provided CVSS v3 vector indicates no privileges or user interaction are required, with low integrity impact and high availability impact.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.