php2shell one week later: Why one exploit doesn’t work everywhere
Co-authored with Joshua Martinelle. This research examines why exploit reproduction depends on the target’s PHP build and runtime configuration, and why a successful shell alone does not establish which vulnerability was used.
I developed the prompts that drove multi-day research into the PHP ecosystem and ran the six-plus-hour agent analysis described in the article. I caught the agent’s hallucinated attribution of a working exploit to the wrong vulnerability, and separately reproduced remote code execution on PHP 7.4.
My investigation, engineering & evidence
I directed agents to deploy lab systems and infrastructure, attach GDB to running processes during live testing, and generate scripts for codebase analysis, fuzzing, and testing. I used those workflows to investigate behavior, validate results, and collect and author evidence of the findings.
The work depended on checking each claimed result against the actual execution path. A working payload was a starting point for verification, rather than sufficient proof of the claimed vulnerability.
The investigation also led me to identify and report a related out-of-memory exposure to the PHP project. Disclosure details are pending.
Published by Tenable; co-author credit is shared. The contribution account above describes my role in the research. ACS is my separate business.