Zend-Engine

PHP 8.5.7 StreamBucket-to-SOAP Numeric Cookie Remote Code Execution

This PoC demonstrates a full memory-corruption-to-RCE chain in PHP 8.5.7 built from three engine/extension behaviors chained together: ArrayIterator can mutate normally-protected internal object properties (bypassing typed-property/visibility/readonly…