| commit b2bdb6159fd0ac3231c426a6c2daf9729915e9ba parent c2999c6653292ecc246d7f90123b089873dd05a7 Author: sqzer <110329244+sqzer-x@users.noreply.github.com> Date: Fri, 23 Oct 2026 14:29:41 +0900 delete image Diffstat:
|
| 1 file changed, 0 insertion(+), 4 deletion(-) |
diff --git a/content/writing/php2shell-cve-2026-109618-cve-2026-109619.md b/content/writing/php2shell-cve-2026-109618-cve-2026-109619.md @@ -44,8 +44,6 @@ The attack unfolds across a 3-stage pipeline: 3. **Stage 3: Memory Re-allocation & Server Hijacking via Secondary Request** The attacker immediately issues a second HTTP request targeted at the same web server worker process. Malicious payload structures (fake function pointers) fill the newly allocated memory space, causing the server to reference the dangling pointer, execute malicious code, or leak sensitive memory data (passwords, API keys, etc.). - - --- ## 3. Deep Technical Analysis: Memory Management Defects @@ -80,8 +78,6 @@ In `CVE-2026-109618`, the flaw leads not only to RCE but also to severe memory l 2. When the second request arrives, the PHP engine treats whatever residual data remains in that memory space (such as database passwords, API keys, encryption tokens, or ASLR bypass addresses from previous operations) as a valid session ID string. 3. PHP URL-encodes this raw memory content and returns it in the `Set-Cookie: PHPSESSID=...` response header, allowing attackers to decode and extract sensitive server secrets directly. - - --- ## 4. Threat Intelligence & Exploit Dynamics |