Critical Remote Code Execution Vulnerabilities Found in PHP Versions Since 5.4

PHP versions dating back to 5.4, released in 2012, contain critical vulnerabilities that can lead to remote code execution on almost every site running unpatched versions. The first vulnerability exploits PHP's memory cleanup mechanism by causing memory allocation failures at precise moments through uploading hundreds or thousands of specially crafted fake files with empty filenames and nested array structures, bypassing the max file uploads limit while exhausting PHP's default 128MB memory limit. The second vulnerability creates a stale pointer by killing requests at exact moments when PHP frees temporary memory but fails to clear pointers to that memory, allowing attackers to use heap grooming techniques to fill the freed memory address with attacker-controlled data. Exploits can manipulate PHP's internal ZVal structures to control both value and type fields, enabling memory leaks that defeat ASLR (address space layout randomization) protections by revealing process memory layouts. The vulnerabilities were originally identified by Khalif, who published a detailed technical blog post. The channel has published a blog post with immediate mitigation actions, and setting memory limit to -1 was mentioned as initial advice to make exploitation more difficult, though this doesn't fix the root cause.