PHP2Chaos

Wow, this whole PHP (PHP2Shell) situation is pure chaos. Everyone seemingly wants credit for it, the disclosure process was apparently botched, (attempted) exploitation is being observed in the wild (though there’s a big difference between a PoC and an actual working, reusable, reliable exploit), and oh, it seems like official patches might also not fully mitigate the vulnerability. Wow, where to begin… Let’s focus on what I think the funniest aspect of this whole thing is (y’know, besides the fact that PHP is still a thing), and that’s the whole who’s-taking-credit-for-finding-the-vuln situation. According to the PHP foundations press release, Quarkslab conducted a security audit of PHP in 2024 and seemingly discovered the underlying issue (OOM) at that time, though this was more of a theory at that point, and no actual exploit was ever cooked up. Fast-forward to 2026, where PHP brought in Calif to conduct yet another audit. During that exercise, Ryan A at Calif discovered the same…