https://x.com/FelipeDaragon/status/2112955772174729264
I believe this is the talk of bypass. I was able to land a similar UAF, but it does not seem exploitable without really going out of your way to make it. None of the major frameworks I looked at (Laravel, WP, Drupal, etc.) had any way of exploiting this. Of course there is the weird one off plugin that I'm sure is doing something dangerous, but nothing off the shelf.
X (formerly Twitter)Felipe Daragon (@FelipeDaragon) on X🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just b…