PHP 8 Sandbox Escape Exploit: Use-After-Free Vulnerability Bypasses disable_functions

Summary

This article describes a PHP 8 sandbox escape proof-of-concept (PoC) that exploits a use-after-free vulnerability to bypass disable_functions restrictions on Unix-like systems. The exploit leverages DateInterval objects to leak heap pointers and obtain read/write primitives, allowing execution of system commands. The PoC has been tested across multiple PHP distributions and server APIs (CLI, PHP-FPM, Apache module) and reproduces deterministically. The article notes that PHP core is memory-unsafe and memory corruption in typical deployments is exploitable.