Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Party
Alexandre Daubois, PHP security team (personal blog)
inside account of the rumours and the leak
Claims this site attributes to this party
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runs fact timeline → | PHP security team (GHSA, oss-security), php.net | confirmed | A6 Established●●●●●● | 3/3 | PHP oss-security php.net |
| The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the next VM safe point and a hard OOM via _exit(); the changelog line is 'Avoid state corruption via bailout' fact timeline → | PHP security team | confirmed | A6 Established●●●●●● | 3/3 | PHP php.net php-src |
| Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safe fact timeline → | php.net; PHP security team | confirmed | A6 Established●●●●●● | 3/3 | php.net oss-security PHP |
| The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down Contradicts the Foundation's 'no technical details leaked' and The Hacker News's 'a proof-of-concept exploit leaked'. No copy of the post, screenshot or video is in the vault. fact timeline → | Alexandre Daubois (PHP security team, personal blog) | reported | A4 Corroborated●●●●○○ disputed | 0/1 | Daubois |
Its sources in the vault
- What the PHP2Shell rumors got wrong, from inside the PHP security team Alexandre Daubois (PHP security team / PHP Foundation)