EIP-2026-104712

PRE-CVE

Apache 2.4.7 + PHP 7.0.2 - 'openssl_seal()' Uninitialized Memory Code Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104712. PoCs published by akat1.

AI-analyzed exploit summary This PHP exploit leverages a memory corruption vulnerability to achieve remote code execution by manipulating EVP_PKEY structures, performing ROP chain execution, and ultimately injecting shellcode into Apache's memory space.

Description

Apache 2.4.7 + PHP 7.0.2 - 'openssl_seal()' Uninitialized Memory Code Execution

Exploits (1)

exploitdb WORKING POC
by akat1 · phpremotephp
https://www.exploit-db.com/exploits/40142

This PHP exploit leverages a memory corruption vulnerability to achieve remote code execution by manipulating EVP_PKEY structures, performing ROP chain execution, and ultimately injecting shellcode into Apache's memory space.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: PHP (libphp7) with Apache2
No auth needed
Prerequisites: Memory leak to determine addresses · PHP with vulnerable OpenSSL/EVP_PKEY handling
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026