[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f39ijdyyqnjjj7":3},{"code":4,"message":5,"data":6,"timestamp":25},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":16,"summary_md":17,"topic":18,"github_topics":21,"license":22,"homepage":22,"updated_at":23,"history":24},"9bie\u002Fphp2shell-bypass-aslr-exp",4,"A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.","Python",1400,412,393,3,[],"Remote PHP RCE against stock Apache prefork mod_php using only HTTP requests and standard php.ini defaults.","## The problem\n\nMost published PHP exploit chains quietly assume a weakened target: `display_errors=On`, a tiny `memory_limit`, a custom ini, or a debugger attached. Real deployments run php.ini-production with errors off and 128M, and a researcher who needs to prove a stock setup is exploitable has nothing to point at. This project reproduces RCE against the official image, official ini and official 150-worker prefork config, delivered over plain HTTP against a page whose only code is `\u003C?php echo \"OK\\n\"; ?>`.\n\n## What's different\n\nThe usual approach to PHP memory-corruption research is either a custom-built target with symbols and a debugger, or a chain that depends on non-default settings for the leak. Here the chain is built from chunked multipart requests that bypass `post_max_size`, a bailout that leaves dangling session state after an OOM in END cleanup, an out-of-bounds read via `Set-Cookie` to leak heap and `libphp` addresses, and a second OOM that redirects `hash_serialize_verifier` to a forged `zend_array`. Worker pinning — occupying 149 of 150 children with half-sent POSTs — is what makes the cross-request dangling pointer land on the same child. The README is unusually explicit about the mechanics and ships per-run evidence logs rather than a single demo video.\n\n## Who it's for\n\nSecurity researchers and pentesters doing authorized work on PHP\u002FApache stacks, and defenders who want to understand how far a pure-HTTP memory-corruption chain can go on a default build. It is useful for WAF and detection engineering: the traffic is just chunked multipart and ordinary GET\u002FPOST, which is worth studying. It is not for anyone looking for a general-purpose scanner — the offsets are calibrated for PHP 8.4.26 NTS mod_php on Debian 13, and anything else needs re-calibration. Hobbyists shouldn't run it against systems they don't own; the README itself scopes it to authorized environments.\n\n## Cost of adoption\n\nYou need Docker (or sudo docker) to bring up the target, Python 3 for the exploit script, and a matching architecture — the project claims x86_64 and aarch64 profiles, with `--arch auto` detection. Changing PHP build or version invalidates the offset table, so expect real work to re-derive offsets. There is no declared license, which is a genuine blocker for any commercial or redistribution use. Maturity is thin: a README, one script, and evidence logs, no test suite. The README is the install guide; it shows cloning the repo and running `.\u002Fpure\u002Frun_pure.sh` before the exploit script.\n\n## Verdict\n\nThis is a brand-new repository — three days old, 1399 stars, averaging +421 per day and reaching #11 on a new board — and it carries the shape of a concentrated disclosure spike rather than an established tool. The technical content is unusually concrete, with named offsets and per-run logs, which is why it drew attention quickly. But with no license, a narrow target matrix and no obvious maintenance plan, treat it as a research artifact and a detection-engineering reference, not as infrastructure. Expect the offset profiles and the chain itself to age quickly as PHP is patched.",{"slug":19,"name":20},"security","Security & Privacy",[],null,"2026-10-24T21:36:37Z",[],1792898438]