From Fuzzer Noise to Zend Engine 0Day - Exploiting a Heap UAF Across All PHP Vuln

The talk begins with a fuzzer report against PHP that was filed under a JIT label, yet the bug reproduces with JIT, opcache and all extensions absent. The speakers trace it to a use-after-free in the core engine's concatenation path, where a destructor triggered during a property write leaves a stale reference behind. They show the defect was already publicly reported and that PHP declined to treat it as a security issue.

The middle of the talk covers turning the crash into a working exploit. A reclaimed object of matching size gives controlled reads and writes, a date-interval technique steers memory access, and the module base is computed from a leaked internal pointer so the system function can be resolved inside the process. The demonstration runs on a distribution build as an unprivileged user with address randomization, PIE and disable_functions enabled. The speakers claim one addition of their own: routing the call through SPL array access rather than calling the function directly. They also say that much of the chain matched earlier public work they found partway through the project.

For defenders, the takeaway is that disable_functions is not an isolation boundary. Process isolation, least privilege and blocking upload or exec footholds matter more. The root cause has a narrow fix, clearing the destination before destroying the old value, which passed their test runs but had not landed upstream at recording time. Sanitizer output showing this free path is a usable detection signal.