[Project] I translated the full PHP 8.4.26 HTTP-only RCE research repository into English, including technical documentation and code comments

The project translates and documents a complex HTTP-only remote code execution exploit against PHP 8.4.26. The exploit chain bypasses ASLR by leveraging out-of-bounds memory reads and uses PHP session-state corruption and heap manipulation to hijack control flow, ultimately achieving code execution without requiring display_errors to be enabled or memory limits to be changed. The exploit works on the official PHP production configuration and Apache prefork MPM with MaxRequestWorkers=150. It involves pinning workers, chunked multipart requests to bypass post_max_size, and precise memory layout manipulations. The research includes extensive technical notes, failed attempts, memory layout analysis, and reproducible proof-of-concept code. The translation effort aims to make this detailed research accessible to English-speaking security professionals.

Successful exploitation results in remote code execution on servers running PHP 8.4.26 with default production settings, including display_errors=Off and memory_limit=128M. This allows an attacker to execute arbitrary system commands remotely via crafted HTTP requests without requiring any configuration changes or enabling debugging features. The exploit has been demonstrated with a 10/10 success rate in tested environments, indicating high reliability under the specified conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider monitoring vendor communications for updates. No vendor advisory or patch information is provided in the source data. The exploit requires no configuration changes to enable, so mitigation through configuration alone may be insufficient.