PHP2SHELL_: PHP vulnerabilities, patches and mitigation

418Removed: -	zend_bailout();
419Removed: -	exit(1);
 … intervening diff lines omitted …
439Added: +	EG(delayed_oom).state = ZEND_OOM_STATE_PENDING;
440Added: +
441Added: +	zend_atomic_bool_store_ex(&EG(vm_interrupt), true);

− Before

The removed allocator path ends in zend_bailout(). That abrupt exit can leave intermediate state inconsistent.

+ What changed

The added path records a pending OOM and signals the VM. The wider fix adds controlled unwinding and safe failure handling; it does not simply raise memory_limit.

The advisory confirms pre-application exploitation on Apache mod_php. This excerpt illustrates the allocator redesign; the complete update also changes callers, parsers, and extensions.

440Added: +	ZVAL_UNDEF(&EG(last_fatal_error_backtrace));
441Added: +	EG(record_errors) = false;
442Added: +	EG(num_errors) = 0;
443Added: +	EG(errors) = NULL;
444Added: +	EG(error_handling) = EH_NORMAL;
445Added: +	EG(exception) = NULL;

− Before

Executor shutdown could leave error-related globals pointing at state that belonged to the completed request.

+ What changed

These additions clear the backtrace, recorded errors, error mode, and exception pointer during shutdown, before early processing of another request can reuse them.

This is one state family. The full patch also changes session and extension lifecycle handling. Disabling a single session feature only removes selected attack paths.