Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Risks / R01 Remote code execution on internet-facing PHP servers / R01-4
R01-4: The fix is incomplete, or a third flaw follows
Because the bailout mechanism is a class of bug and the 8.5.12 fix may be incomplete, a patched server may still be reachable by another path, resulting in a second emergency on systems already declared done.
Rating 15 high · Likelihood 3 Possible · Impact 5 Severe · Kind Security · Acceptance not recorded
Basis. Reported by Fastly and in the oss-security thread; unverified as to a specific third bug.
The path
Who carries it
One risk, assigned to every stakeholder that carries part of it, with the part each plays.
| Stakeholder | Part | Why | Its register |
|---|---|---|---|
| The fix authors | owner | Own the design of the fix and its completeness. | 1 risk |
| The PHP security team | treater | Receives and coordinates the next report. | 7 risks |
| Organisations running PHP | bearer | Will patch again. | 26 risks |
| Platform engineers and developers | bearer | Rebuild and redeploy a second time, on systems already signed off. | 4 risks |
| The finders | informer | Already looking at the same code with the same tools. | 7 risks |
What it arises from
- Bailout as a class of bug. Patching the demonstrated paths does not make the mechanism safe: other paths to the same bailout should be expected.
The evidence
| Claim | Status | Fact-check | Sources |
|---|---|---|---|
| The 8.5.12 fix may be incomplete, or there is a third, different bug | unverified | A1 Weak signal●○○○○○ | oss-security |
| Patching the demonstrated paths does not make the bailout mechanism safe; more paths should be expected | reported | A2 Reported●●○○○○ | Fastly oss-security |
| The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the next VM safe point and a hard OOM via _exit(); the changelog line is 'Avoid state corruption via bailout' | confirmed | A6 Established●●●●●● | PHP php.net php-src |
Treatments
| Treatment | Status | Where |
|---|---|---|
| The fix replaces the longjmp bailout with a delayed soft limit and a clean hard exit | partial | The fix, mapped to the code |
| Keep detection and filters after patching | partial | Detection and defence: what blocks php2shell and what shows it |
The standards that govern it
| Framework | Control | What it asks | Family |
|---|---|---|---|
| NIST SSDF | RV.3 | Analyse vulnerabilities to identify their root causes | Frameworks and control catalogues |
| NIST SSDF | PW.8 | Test executable code to find vulnerabilities | Frameworks and control catalogues |
| ISO/IEC 27001 | A.8.29 | Security testing in development and acceptance | Management-system standards |
| ISO/IEC 29147 and 30111 | 30111:handling | Investigating, remediating and releasing the fix, and learning from it | Practice and technique |
The stories that tell it
- Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third
- Where php2shell stands: many sites dark, millions of attempts, no confirmed breach (through Remote code execution on internet-facing PHP servers)
On this site: The fix, mapped to the code · The code: where php2shell lives and what the fix does