x.comthreadTrail of Bits (@trailofbits) on X
Trail of Bits post on PHP2Shell, an exploit that gives a shell on MediaWiki, Symfony, Laravel and phpBB. They confirmed it on pre-patch PHP 8.2 to 8.5. An update says it is production-grade: it works with stock php.ini-production, display_errors off, multiple workers, ASLR and load, on ARM64 and x86-64, and reaches root on Apache/mod_php and nginx/php-fpm. No CVE or technical root cause is given.
TL;DR Trail of Bits shows PHP2Shell, a reliable PHP 8.2-8.5 exploit that gives a shell or root on common PHP apps and servers.
Technologies named here
- PHP 8.2 to 8.5
- MediaWiki
- Symfony
- Laravel
- phpBB
- WordPress
- Apache with mod_php
- nginx with php-fpm
- PHP
- Apache
- nginx
- Trail of Bits
Threat actors named here
Related in Offensive Security
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
github.comrepoYesWeHack Claude Kit
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup