Two unauthenticated PHP RCEs: one longjmp, one leftover state

Your PHP site can be broken by a request carrying no credentials, even when every page demands a login. The flaw sits in how PHP handles a request, not in your code: exiting on memory exhaustion leaves half-initialised request data behind, and state carried across requests can point at memory already freed. Both fire before your code runs; exploitation is demonstrated against Apache mod_php.

Read report →