Auto-generated by p2s_matrix.py · last update 2026-10-26
Test probe = blind sleep-timing verifier (p2s_verify.py, no artifacts). zif/dtor are the exact static offsets from that build's libphp.so; htdata is the per-minor value, sweep k = pages off the DB base.
| Version | Build / source | zif | dtor | htdata | k | Result | Detected via |
|---|---|---|---|---|---|---|---|
| 8.2.34 | - | - | - | - | - | X-Powered-By: PHP/8.2.34 | |
| 8.3.35 | official php:8.3-apache (debian trixie) | 0x3ac080 | 0x49ec50 | 0x6a0d8 | +0 | ✅ WORKS | X-Powered-By: PHP/8.3.35 |
| 8.4.26 | official php:8.4-apache (debian trixie) | 0x465370 | 0x65eb60 | 0x690d8 | +0 | ✅ WORKS | X-Powered-By: PHP/8.4.26 |
| 8.5.11 | official php:8.5-apache (debian trixie) | 0x5996e0 | 0x7b47a0 | 0x690d8 | +0 | ✅ WORKS | X-Powered-By: PHP/8.5.11 |
3/4 targets confirmed exploitable.