“It works entirely over ordinary HTTP requests in three broad steps: it recycles the target's PHP worker, leaks memory addresses through the session cookie to defeat address space layout randomization (ASLR), and then abuses PHP's session upload progress handling to run a shell command.”

SOCRadar · said date not stated · reported 2026-10-23

SOCRadar described how the exploit works over HTTP requests to bypass ASLR and execute shell commands.