# PHP2Shell — interactive edition

Checked 31 October 2026. Scope: the original CVE pair. The state explorer is a deterministic explanatory model, not PHP execution, a vulnerability scanner, or a measured exploit.

## Evidence map

- Memory-pressure sources and the safe soft/hard OOM behavior: [PHP OOM advisory](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w).
- Producer/consumer conditions, state reset, same-worker requirement and remediation limits: [PHP stale-state advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp).
- Insertion order: [HashTable source, PHP 8.4.26](https://github.com/php/php-src/blob/php-8.4.26/Zend/zend_hash.c#L960-L980).
- Body parsing before module activation and conditional extension shutdown: [main.c](https://github.com/php/php-src/blob/php-8.4.26/main/main.c#L1873-L1875), [shutdown](https://github.com/php/php-src/blob/php-8.4.26/main/main.c#L1928-L1965).
- Early session callbacks: [session.c](https://github.com/php/php-src/blob/php-8.4.26/ext/session/session.c#L3277-L3387).
- Decoder context publication/reset and value-slot bookkeeping: [var_unserializer.re](https://github.com/php/php-src/blob/php-8.4.26/ext/standard/var_unserializer.re#L60-L95).
- Worker exit after failed startup: [FPM request loop](https://github.com/php/php-src/blob/php-8.4.26/sapi/fpm/fpm/fpm_main.c#L1870-L1876).
- First fixed releases: [PHP Foundation release](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/).

## Model boundaries

The workbench shows selected fields and events. A freed address, reclaimed storage and successful code execution are different milestones. Allocation reuse is possible, not guaranteed. FPM startup failure stops the illustrated startup paths; application-dependent post-startup paths remain relevant. Switching workers misses that producer’s globals; it does not repair the original worker. The patched comparison shows lifecycle guarantees, not exact allocator execution.

The existing PNG remains a compact illustrated overview. The HTML article contains the expanded technical explanation, source links and interactive paths.