php2shell v1.7.0: Complete Bilingual Documentation & Stock Calibration

php2shell Research v1.7.0 — Official Stock Calibration & FastCGI Boundary Update

Key Technical Updates

1. Stock Distribution Image Verification (php:8.4.26-fpm):

   • Demonstrated that the E-OOM controlled write primitive operates identically on official production images (Debian 13 Bookworm/Trixie) without requiring custom debug/symbol builds.
   • Exact measured layout:
     • sapi_module base: 0x555556ae1a00
     • &sapi_module.ub_write: 0x555556ae1a30 (offset +0x30)
     • &system (libc): 0x7ffff7096090
     • Alignment verification: (T2 - d - 0x110) % 16 == 0 strictly satisfied.

2. FastCGI Stdout Isolation Falsification:

   • Confirmed via raw TCP captures that FastCGI suppresses stdout in-band infoleaks (0 leaked pointers in HTTP headers/body upon OOM aborts).
   • Timing side-channel delta ($\Delta = 0.170\text{ ms}$) proven unviable under network jitter.

3. Process-Level Operational Boundary (setarch x86_64 -R):

   • Validated that the execution primitive requires ASLR disabled at the process tree level (ADDR_NO_RANDOMIZE).
   • Under active system-wide ASLR without an auxiliary memory leak, the chain degrades deterministically to a Denial of Service (P3).

4. Bilingual Documentation Harmonization:

   • Synchronized technical findings across English (README.md, REPORT.md, EVIDENCE.md) and Spanish (RESUMEN.md) with zero exploit weapons disclosed.