ikow/php2shell-poc

The problem

A PHP vulnerability class that survives 14 years of releases is a defender's nightmare: you cannot read the app, patch it, or reason about it from the outside. This repo publishes five RCE chains around session.upload_progress and Zend engine OOM handling, plus detection rules and a Docker lab, so security teams can verify exposure and block the traffic instead of arguing about CVSS scores.

What's different

Most PHP exploit repos ship a single PoC and stop at reproduction. This one bundles the exploit, the verification scripts, a multi-SAPI lab (FPM, nginx, Apache mod_php) and drop-in rules for Suricata, Sigma, ModSecurity and OpenResty in one tree. The chains are also graded by precondition — from "app has an LFI sink" up to "any endpoint" — which is the detail defenders actually need to triage. Notably, two of the five chains, including the zero-dependency one, are withheld behind a paid Substack subscription; the free repo is a partial disclosure.

Who it's for

Security engineers, pentesters with written authorization, and sysadmins running PHP-FPM or mod_php who need to confirm whether their stack is exposed and deploy WAF/IDS signatures today. It is not for application developers who just want to fix their own code — the actionable output for them is a one-line INI change and a PHP patch, not exploit tooling. It also assumes comfort with Docker, Python 3 and reading PHP internals.

Cost of adoption

Python for the driver scripts, PHP for Chain B, Docker Compose for the lab. MIT-licensed code, but the most severe chains (D and E) are gated, so "complete coverage" is not free. The README is thin on methodology: the CVE identifiers, GHSA links and patch commit are given without the underlying analysis, and the full writeup lives off-site. Treat the claims as a starting point to verify in the lab, not as settled fact. The ruleset is a snapshot, so expect to tune signatures against your own traffic to avoid false positives on file uploads.

Verdict

The repo went from zero to roughly 1,750 stars in three days — a publication spike tied to the disclosure, not a community that has stress-tested it. There is no Hacker News thread and no trending-board history, so the signal is one burst plus a paid-content funnel. The free chains plus the detection rules are genuinely useful for defenders within a patch window; the paywalled zero-dependency chains weaken its value as a reference. Use it to drive a patching and WAF rollout, and do not rely on it as your only source on the vulnerability.