What happened
According to a post-mortem published by the PHP Foundation, a critical remote code execution (RCE) vulnerability in PHP's error-handling mechanism was known to a small team of maintainers about two years before it was made public. The team debated the best fix while preserving compatibility with third-party extensions, and the flaw began being exploited before it was disclosed.
Technical root cause
The issue stems from the longjmp() C function that the PHP engine calls when a process runs out of memory. This function abruptly jumps execution elsewhere. If the jump happens while a data structure (such as an array entry or an object) is being built, half-finished data remains in the memory heap. When the cleanup code runs on these inconsistent leftover bytes, an attacker who injects the right content can execute arbitrary code with PHP's permissions.
The PHP2Shell exploit
The active PHP2Shell exploit chains this mechanism to gain a remote shell. A successful attack requires knowing the exact PHP version and build of the target, but tens of millions of servers running the same version widen the attack surface. After the vulnerability was disclosed, many sysadmins disabled version-number reporting.
The real problem: understaffing
According to the report, the PHP Foundation maintains one of the internet's most widespread pieces of software with one full-time employee and 14 part-time contractors. At disclosure, 73% of online PHP installations were running end-of-life versions with no active support. Currently maintained branches range from PHP 8.1 to 8.5; upgrading from PHP 7 requires revision work due to language changes.
