php2shell-zeros — surviving bugs in PHP's 2026-10-21 security releases
Two zeros: the session-gaps family (full RCE) and the var_destroy re-entry UAF (ASAN-deterministic memory-safety violation, first demonstration). Zero2's base bug is publicly known and filed by its discoverer — our contribution there is receipts, remote kill, and the allocator-wall analysis. Zero...
はてなテクノロジー
2026年10月22日 06:29