Skip to content

1.9.2: patch state checked against php.net and php-src #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JoshRob297 merged 1 commit into from
Nov 10, 2026
Merged

1.9.2: patch state checked against php.net and php-src #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions COVERAGE.es.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,20 @@

---

## Estado de parches (verificado el 2026-11-09)

- **La última versión estable es 8.4.27 / 8.5.12** (21 oct). No ha salido 8.4.28 ni 8.5.13:
ambas están etiquetadas como RC1 el 3–4 de noviembre, solo para pruebas.
- **CVE-2026-115560 no tiene arreglo estable.** El aviso completo sigue sin publicarse y la
mitigación del 23 de oct sigue vigente: `session.upload_progress.enabled=0`.
- **`ext/session: prevent creation of fixed sid in php_session_rfc1867` (PR #22113 de php-src)
sigue abierto**, así que la guarda de SID fijo que la sección 3 registra como ausente sigue
ausente en todas las versiones.
- **8.4.27 / 8.5.12 trajeron una regresión**: GH-24488, doble liberación en el GC de
`SimpleXMLElement` que termina en `zend_mm_heap corrupted`. Corregida en php-src para 8.4.28,
que no ha salido. Si un host en 8.4.27 corrompe el heap con uso intensivo de SimpleXML, no es
este clúster.

Definiciones de estado:

- **fail**: la vulnerabilidad o vector tuvo éxito bajo las condiciones medidas.
Expand Down
12 changes: 12 additions & 0 deletions COVERAGE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,18 @@

---

## Patch state (checked 2026-11-09)

- **Latest stable is 8.4.27 / 8.5.12** (21 Oct). No 8.4.28 or 8.5.13 has shipped: both are
tagged RC1 on 3–4 Nov, for testing only.
- **CVE-2026-115560 has no stable fix.** The full advisory is still unpublished and the
23 Oct mitigation stands: `session.upload_progress.enabled=0`.
- **`ext/session: prevent creation of fixed sid in php_session_rfc1867` (php-src PR #22113) is
still open**, so the fixed-SID guard recorded as absent in §3 is absent from every release.
- **8.4.27 / 8.5.12 shipped a regression**: GH-24488, a `SimpleXMLElement` GC double free that
ends in `zend_mm_heap corrupted`. Fixed in php-src for 8.4.28, which has not shipped. If a
host on 8.4.27 corrupts its heap under heavy SimpleXML use, it is not this cluster.

Status definitions:

- **fail**: the vulnerability or chain succeeded in the tested conditions.
Expand Down
8 changes: 4 additions & 4 deletions README.es.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
# php2shell — Verificación Independiente y Auditoría de Límites de Explotación
### CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560

[![Release](https://img.shields.io/badge/Release-v1.9.1_(2026--10--31)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.1)
[![Release](https://img.shields.io/badge/Release-v1.9.2_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.2)
[![Target](https://img.shields.io/badge/Objetivos_PHP-8.2_·_8.3_·_8.4_·_8.5-334155?style=flat-square)](#)
[![CVSS](https://img.shields.io/badge/CVSS_v4.0-9.2_CRÍTICO-b91c1c?style=flat-square)](#)
[![ASLR](https://img.shields.io/badge/ASLR-Ventana_Cookie_1.88_MB-d97706?style=flat-square)](#)
[![PDF](https://img.shields.io/badge/Descargar-Informe_Técnico_(PDF)-059669?style=flat-square&logo=adobeacrobatreader)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.1)
[![PDF](https://img.shields.io/badge/Descargar-Informe_Técnico_(PDF)-059669?style=flat-square&logo=adobeacrobatreader)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.2)

**Un estudio exhaustivo de microarquitectura y asignador de memoria por JoshRob**
*Verificación independiente de afirmaciones públicas de evasión de ASLR, límites de POST chunked y divulgación de free-lists en el heap de Zend MM.*
Expand All @@ -19,7 +19,7 @@ Contacto: Telegram [@JocesLab](https://t.me/JocesLab) · correo [joshrob.sec@pro
---
</div>

- **Estado**: Publicación v1.9.1, 2026-10-31 (calibración en imágenes oficiales de distribución, pruebas de aislamiento de stdout en FastCGI, desambiguación de arquitecturas SAPI, alcance de ASLR medido por tamaño de lectura, transcripciones por corrida de la cadena 9bie y arnés de medición publicado).
- **Estado**: Publicación v1.9.2, 2026-11-09 (verificación del estado de parches contra php.net y php-src, más el puntero de v1.0.0 a la última; calibración en imágenes oficiales de distribución, pruebas de aislamiento de stdout en FastCGI, desambiguación de arquitecturas SAPI, alcance de ASLR medido por tamaño de lectura, transcripciones por corrida de la cadena 9bie y arnés de medición publicado).
- **Alcance**: Ramas de PHP 8.4.x y adyacentes (8.2, 8.3, 8.5), imágenes oficiales en contenedores, código público de prueba de concepto (PoC) y reproducción independiente en laboratorio.
- **Alcance aplicativo**: Se utilizó un entorno de prueba de Nextcloud 33.0.x (PHP 8.4.21, Apache `mod_php` prefork) para validar la exposición de configuración y nivel de parche. La prueba de RCE se obtuvo sobre la imagen oficial `php:8.4.26-apache`. El fallo reside en el inicio de la petición de PHP, no en el código de Nextcloud.
- **Artefactos**: Versiones formales en PDF (`REPORT.pdf` y `RESUMEN.pdf`), instrumentación de laboratorio reproducible (`tooling/labkit/` y `tooling/docker-compose.yml`), herramienta de diagnóstico no destructiva (`tooling/checker/`), calculadoras offline de alcanzabilidad y reglas de detección.
Expand Down Expand Up @@ -177,7 +177,7 @@ cd lab && python3 -m pytest tests/ exploit/tests/ -q # 147 passed, 4 skipped
| [`CONTACT.md`](CONTACT.md) | Solicitudes de acceso al repositorio privado y discusión relacionada |

> [!TIP]
> **Publicación oficial en PDF**: Las versiones con tipografía formal de `REPORT.md` (13 páginas, A4) y `REPORT.es.md` (3 páginas, A4), con sumas de verificación en `SHA256SUMS`, están disponibles en la [página de la versión v1.9.1](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.1).
> **Publicación oficial en PDF**: Las versiones con tipografía formal de `REPORT.md` (13 páginas, A4) y `REPORT.es.md` (3 páginas, A4), con sumas de verificación en `SHA256SUMS`, están disponibles en la [página de la versión v1.9.1](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.2).

---

Expand Down
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
# php2shell — Independent Verification & Exploitation Boundary Audit
### CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560

[![Release](https://img.shields.io/badge/Release-v1.9.1_(2026--10--31)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.1)
[![Release](https://img.shields.io/badge/Release-v1.9.2_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.2)
[![Target](https://img.shields.io/badge/PHP_Targets-8.2_·_8.3_·_8.4_·_8.5-334155?style=flat-square)](#)
[![CVSS](https://img.shields.io/badge/CVSS_v4.0-9.2_CRITICAL-b91c1c?style=flat-square)](#)
[![ASLR](https://img.shields.io/badge/ASLR-Cookie_Window_1.88_MB-d97706?style=flat-square)](#)
[![PDF](https://img.shields.io/badge/Download-Technical_Report_(PDF)-059669?style=flat-square&logo=adobeacrobatreader)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.1)
[![PDF](https://img.shields.io/badge/Download-Technical_Report_(PDF)-059669?style=flat-square&logo=adobeacrobatreader)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.2)

**An exhaustive memory-allocator & microarchitecture study by JoshRob**
*Independent verification of public ASLR bypass claims, chunked POST boundaries, and Zend MM free-list heap disclosure.*
Expand All @@ -19,7 +19,7 @@ Contact: Telegram [@JocesLab](https://t.me/JocesLab) · email [joshrob.sec@proto
---
</div>

- **Status**: public release v1.9.1, 2026-10-31 (official stock distribution image calibration, FastCGI stdout isolation proofs, SAPI architecture disambiguation, measured ASLR scope per read size, per-run 9bie transcripts, and the published measurement harness).
- **Status**: public release v1.9.2, 2026-11-09 (patch-state check against php.net and php-src, plus the v1.0.0→latest pointer; official stock distribution image calibration, FastCGI stdout isolation proofs, SAPI architecture disambiguation, measured ASLR scope per read size, per-run 9bie transcripts, and the published measurement harness).
- **Scope**: PHP 8.4.x and adjacent branches (8.2, 8.3, 8.5), official PHP container images, public proof-of-concept code, and independent lab reproduction.
- **Application scope**: a Nextcloud 33.0.x test deployment (PHP 8.4.21, Apache `mod_php` prefork) was used to validate the exposed configuration and patch level. The RCE proof was obtained on the official `php:8.4.26-apache` image. The bug is in PHP request startup, not Nextcloud code.
- **Artifacts**: formal typography PDF releases (`REPORT.pdf` and `RESUMEN.pdf`), reproducible lab instrumentation (`tooling/labkit/` and `tooling/docker-compose.yml`), non-destructive diagnostic tooling (`tooling/checker/`), offline reachability calculators, and detection rules.
Expand Down Expand Up @@ -182,7 +182,7 @@ cd lab && python3 -m pytest tests/ exploit/tests/ -q # 147 passed, 4 skipped
| [`LICENSE`](LICENSE) | CC BY 4.0 license notice |

> [!TIP]
> **Official Formatted PDF Release**: Formatted typography versions of `REPORT.md` (13 pages, A4) and `REPORT.es.md` (3 pages, A4), with verified checksums in `SHA256SUMS`, are available on the [v1.9.1 Release Page](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.1).
> **Official Formatted PDF Release**: Formatted typography versions of `REPORT.md` (13 pages, A4) and `REPORT.es.md` (3 pages, A4), with verified checksums in `SHA256SUMS`, are available on the [v1.9.1 Release Page](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.9.2).

---

Expand Down
8 changes: 8 additions & 0 deletions RESUMEN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# RESÚMEN.md se movió

Este archivo se llamaba `RESUMEN.md`. La documentación quedó bilingüe con nombres simétricos,
y el resumen en español vive ahora en **[REPORT.es.md](REPORT.es.md)**; el informe completo en
inglés está en **[REPORT.md](REPORT.md)**. La versión con tipografía formal, en PDF, se publica
con cada [release](../../releases/latest).

Este archivo existe solo para que los enlaces antiguos no terminen en un 404.
Loading