# SANS dissects php2shell PHP RCE exploit chain

Published: 2026-10-23 · Severity: routine · Sectors: Technology · Not tied to an actor or CVE
Canonical: https://vorant.io/reports/c12f5682-7c7d-5264-bed9-793371b89bab/sans-dissects-php2shell-php-rce-exploit-chain
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> SANS ISC analysis finds the 'php2shell' PHP memory-corruption RCE PoCs require tight prerequisites, making reliable exploitation harder than first assumed.

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33452

## What to check

- Applies to: Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.

SANS Internet Storm Center published an analysis of publicly released proof-of-concept exploits for the so-called 'php2shell' vulnerability, a PHP/Apache memory-corruption issue tied to session.upload_progress handling. The author examined several PoCs - many apparently AI-generated and low quality - and found that the one functional exploit relies on a series of demanding preconditions: a crafted POST request with precisely sized fields to force emalloc failure (requiring a low memory_limit of 8 MB, uncommon versus the typical 128 MB default), and a single-worker prefork Apache configuration to guarantee exploit state lands on the targeted worker, which is unrealistic in most multi-worker production environments.

The exploit chain proceeds in phases: leaking the Zend MM chunk base to compute HashTable offsets, then leaking the libphp.so base address via a static-offset code pointer (zval_ptr_dtor) to defeat ASLR, and finally overwriting pDestructor with zif_system to achieve code execution, limited to a 14-byte command. The author notes the demonstrated PoCs 'cheat' by reading these offsets directly from the server rather than deriving them blind, meaning real-world attackers would need to pre-compile offset tables for common distro/PHP version/compiler combinations to weaponize this reliably.

No confirmed in-the-wild exploitation is reported; this is exploitability research rather than an active-campaign writeup. SANS reiterates the vendor mitigation of setting session.upload_progress.enabled = 0, warning that the officially available patch reportedly has a known bypass, so the configuration workaround should remain in place until a further fix is released.

Source reporting: https://isc.sans.edu/diary/rss/33452

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c12f5682-7c7d-5264-bed9-793371b89bab/sans-dissects-php2shell-php-rce-exploit-chain.
The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup