Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Party
Jakub Zelenka (bukka), PHP security team
published both GitHub advisories and the oss-security announcements
Claims this site attributes to this party
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runs fact timeline → | PHP security team (GHSA, oss-security), php.net | confirmed | A6 Established●●●●●● | 3/3 | PHP oss-security php.net |
| The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the next VM safe point and a hard OOM via _exit(); the changelog line is 'Avoid state corruption via bailout' fact timeline → | PHP security team | confirmed | A6 Established●●●●●● | 3/3 | PHP php.net php-src |
| Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safe fact timeline → | php.net; PHP security team | confirmed | A6 Established●●●●●● | 3/3 | php.net oss-security PHP |
| The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down Contradicts the Foundation's 'no technical details leaked' and The Hacker News's 'a proof-of-concept exploit leaked'. No copy of the post, screenshot or video is in the vault. fact timeline → | Alexandre Daubois (PHP security team, personal blog) | reported | A4 Corroborated●●●●○○ disputed | 0/1 | Daubois |
Its sources in the vault
- RCE via OOM corruption (CVE-2026-109618) PHP (php/php-src GitHub security advisory, published by bukka)
- CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption oss-security list (Jakub Zelenka, PHP security team)