PHP2Shell: Early flagged the defect in the change that introduced it.
Early flagged the PHP2Shell memory-lifetime defect and a separate initialization bug in a replay of the January 2025 change. In a follow-up on the vulnerable revision, Early created a Fix PR for the backtrace defect.
A later error could access freed request memory.
A PHP change added backtraces for fatal errors. A shutdown path freed the request’s memory but left a reference to its backtrace behind. A later request could reach that freed memory.
Why engineering should care
The value is earlier intervention: giving engineers a specific bug to investigate when a change introduces it, rather than after its consequences emerge in production.
3 findings surfaced for action.
Early analyzed the January 2025 Zend change and flagged the backtrace defect alongside two other actionable findings.
Early flagged the memory defect.
Early verdict · BUG
“Backtrace global not cleared on fast shutdown”
Early pointed engineers to the shutdown cleanup path and the stale reference it left behind. Fast shutdown could free the request’s memory while the backtrace global still pointed to it. An early error in a later request could reach that freed memory.
From finding to Fix PR
Early created a Fix PR that clears the stale backtrace reference during shutdown.
ZVAL_UNDEF(&EG(last_fatal_error_backtrace));Compilation/runtime verification pending · No new test added
Primary evidence
Follow the evidence.
The original detection run was a targeted historical replay performed after disclosure. A single replay does not establish reliable detection during routine operation in 2025. The later repair exercise targeted a branch at the vulnerable revision. Exploit reproduction was outside the scope.
Independent retrospective replay. No affiliation with PHP or Wiz. Discovery and exploitation credit belongs to the disclosure researchers.
Explore more Case Files