User talk:Gigaphono

2026-10-23T02:44:30Z

Gigaphono: Thanks for the Automoderated rank.

Welcome to the new Hunkypedia! I'm glad to see you return. --[[User:SovietHunky|SovietHunky]] ([[User talk:SovietHunky|talk]]) 09:10, 22 October 2026 (UTC)
:Hello there, thanks for the warm welcome. And sorry for disapearing for like a month geg, i was busy with IRL stuff. [[User:Gigaphono|Gigaphono]] ([[User talk:Gigaphono|talk]])
::No problem. BTW, I have just promoted you to an automoderated user, which means any further edits you make will bypass approval. --[[User:SovietHunky|SovietHunky]] ([[User talk:SovietHunky|talk]]) 01:36, 23 October 2026 (UTC)
:::Ok, thanks for the trust. I will be making more snca articles in the future, cuz rigth now im busy telling other imageboard owners about the PHP vulnerabilities. Also if you dont mind i will start to tell more people about this new wiki as a bunker. SNCApedia keeps being DDoSed and the Soywiki has become terrible under the new Salt Administration.
:::Anyways goodbye for now. [[File:HunkyPedia.png|300px|Right|]][[User:Gigaphono|Gigaphono]] ([[User talk:Gigaphono|talk]]) 23 October 2026 (UTC)

File:HunkyPedia.png

2026-10-23T02:42:39Z

Gigaphono:

User talk:Gigaphono

2026-10-23T01:16:09Z

Gigaphono: hello.

PHP2Shell

2026-10-23T01:11:24Z

Gigaphono: Creation of the PHP2Shell Article (Meant to do this yesterday but i forgot to press save page geg)

The PHP2Shell<ref>https://www.php2shell.com/</ref> exploit are a set of two vulnerabilities (CVE-2026-109618 and CVE-2026-109619)<ref>https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp</ref><ref>https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w</ref> than affect the core of PHP from the version 5.4 to 8.6 <ref>https://en.wikipedia.org/wiki/PHP2Shell</ref>, they are reported to be a level 9.2 on the CVSS scale<ref>https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html</ref> ←[[This is le bad]] and has caused a lot of chaos on the whole internet [[or something|o algo.]] [[File:PHP2Shell.png|300px|Right|]]
==Impact==
Its estimated that around [[not nice actually, stop laughing at dumb numbers. Thats like weird or something. OK?|69%]] of the internet runs on PHP,<ref>https://w3techs.com/technologies/details/pl-php</ref> and therefore most websites have been affected. [[File:PHPWebsites.png|300px|Right|]] Some examples are goverment sites, imageboards, forums, games, etc.<ref>https://mashable.com/tech/php-vulnerability-websites-offline-affected-services</ref>, and although an exact number of websites has not been said, [[schizo|based on my calculations]], atleast [[like 4 holocausts or something like that|25 Million]] websites could be affected.<ref>https://publicwww.com/websites/.PHP/</ref> This video shows the exploit in a controlled enviroment against wordpress [[File:wordpress.mp4|300px|Right|]]<ref>https://www.php2shell.com/</ref>
==How it works==
The two vulnerabilities act slighty differently but allow an attacker to reach the same goal of remote execute malicious code through the same mechanism of embeding invalid memory data by just sending some modified HTTP POST requests.<ref>https://blog.cloudflare.com/php-vulnerabilities-waf-protection</ref>

CVE-2026-109618 (RCE via out-of-memory): Works by sending a modified request that overflows the memory limit allocation system causing it to crash but leaving invalid cached memory data in it that its later executed when the system tries to do a cleanup.
This vulnerability allows attackers to inject malicious code and cause denial of service by exhausting the server resources.
Heres the error message: "PHP Fatal error: Allowed memory size of 16777216 bytes exhausted (tried to allocate 3670048 bytes) in Unknown on line 0" <ref>https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/</ref>

CVE-2026-109619 (RCE via stale global state): Works by exploiting the same mechanism of the previous vulnerability but targeting global variables and using multiple requests, the first step targets a global state variable in a PHP process worker, crashing it and causes the invalid memory to get embed in it even after being reset, then the second request causes the worker to read the cached invalid memory and execute malicious code or cause a memory dump leak of the websites stored information. <ref>https://nvd.nist.gov/vuln/detail/cve-2026-109619</ref>
This allows attackers to access user data, API keys, Passwords, enviromental variables and even gain privilege to the backend servers and websites.
[[File:PHP2ShellVulnerabilites.png|300px|Right|]]
==Solution==
The only solution its to upgrade to the latest version of PHP and then restart the servers your site its running in.
Heres the image on what branches and version should be updated.<ref>https://www.php2shell.com/#upgrade-php</ref> [[File:SolutionPHP2Shell.png|300px|Right|]]
And heres the guide on how to do it. https://www.php.net/archive/2026.php#2026-10-21-5
==SNCA==
~The vulnerabilities where found by [[Jews|OpenAI]]<ref>https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/</ref> and by [[Jews again|Wiz]]<ref>https://www.wiz.io/blog/php2shell-php-rce</ref> in a dual effort to patch cybersecurity exploits and vulnerabilities.

~This incident marks the 2th time that imageboards source code have been affected by 0-day AI vulnerabilities (see vichan incident or something like that), the only remaining "safe" mainstream code engine that remains for now its jschan.

~Searching for info i found this comic that explain the situation in great detail. https://calif.io/php2shell/

~Also this its how i found out about the situation [[https://8chan.moe/b/res/596020.html#596704 shit nophono cares fan about]]
{{reflist}}

File:PHP2ShellVulnerabilites.png

2026-10-22T23:28:59Z

Gigaphono:

File:PHPWebsites.png

2026-10-22T23:28:13Z

Gigaphono:

File:SolutionPHP2Shell.png

2026-10-22T10:17:12Z

Gigaphono:

File:Wordpress.mp4

2026-10-22T10:03:32Z

Gigaphono: PHP2Shell exploit in wordpress

== Summary ==
PHP2Shell exploit in wordpress

File:PHP2Shell.png

2026-10-22T09:36:53Z

Gigaphono: Screenshot of the PHP2Shell site

== Summary ==
Screenshot of the PHP2Shell site

User:Gigaphono

2026-10-22T09:05:31Z

Gigaphono: testing

::test::
==test==
---test---

Hunkypedia - User contributions [en]

User talk:Gigaphono

File:HunkyPedia.png

User talk:Gigaphono

PHP2Shell

File:PHP2ShellVulnerabilites.png

File:PHPWebsites.png

File:SolutionPHP2Shell.png

File:Wordpress.mp4

File:PHP2Shell.png

User:Gigaphono