PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
| Vendor | Product | Versions |
|---|---|---|
| PHP Group | PHP | 8.2.*, 8.3.*, 8.4.*, 8.5.* |
Loading…
Article confirms affected versions include PHP 7.4, 8.0, 8.1, and versions back to 5.4, plus minimal source backports were released for older versions
Updated patch availability to null due to reports of incomplete fix in PHP 8.5.12, added 'incomplete-patch' tag, and noted possible separate vulnerability.
Updated severity from NONE to CRITICAL, expanded affected versions to include PHP 5.4-8.1 (all versions since 5.4), and added SNORT detection signatures, deployment platform tags, and threat actor information.
Updated severity from NONE to CRITICAL, confirmed exploit availability and active exploitation expected in-the-wild, and added new tags for OOM handling and session lifecycle RCE attack vectors.
Article confirms active in-the-wild exploitation by attackers and availability of proof-of-concept tools, contradicting the current record's activelyExploited=false status.
Article reveals vulnerability affects PHP versions since PHP 5 (not just 8.2+); added CVE identifiers and additional technical tags related to memory-limit directive and error-handling exploitation.
Article confirms active exploitation in the wild and provides additional context on exploit availability; added PHP2Shell tag and affected server configurations (mod_php, PHP-FPM, Apache, etc.)
Updated severity from NONE to CRITICAL based on vendor classification, and added MITRE ATT&CK technique T1190 for remote code execution vector.
Updated severity to CRITICAL and CVSS score to 9.2, confirmed exploit availability and active exploitation (proof of concept seen, at least one government website taken offline)
Initial creation
