The Code Log
Welcome to my blog, a space where I share insights, lessons, and best practices from building secure, scalable web applications and SaaS solutions. From tackling complex development challenges to exploring modern tools, frameworks, and security techniques, this is where I document what works, what doesn’t.
PHP2Shell Internals: From a Half-Written Bucket to system()
The engine-level follow-up to the PHP2Shell story. It walks the half-written bucket in CVE-2026-109618, the forged zend_string that leaks 800 KB of worker memory, and the fake zend_reference and zend_array that turn array cleanup into a call to zif_system(). Includes the struct layouts, offsets, and full destructor chain.
PHP2Shell: CVE-2026-109618 and CVE-2026-109619 Explained
PHP2Shell is two memory-safety bugs in PHP itself. One corrupts a Zend hash table during an OOM bailout; the other lets stale worker state survive into the next request. This post covers the impact, affected versions, the patch, and what to check if you were exposed.
Race Condition in Laravel: Bypassing Login Rate Limiting with Concurrent Requests
Laravel’s stock login scaffolding has a five-attempts-per-minute lockout that works fine against sequential guesses but falls apart under concurrency. This post breaks down the race condition in AuthenticatesUsers, where the failure count is checked before the slow bcrypt comparison but only written after it, and shows a proof-of-concept where a burst of twenty requests slips past the limit. It closes with three practical fixes, including reordering the increment and adding route-level throttling.