Security

PEAR (PHP Extension and Application Repository)

A legacy PHP package system whose command helper ships on many PHP hosts. When request-argument parsing is enabled, that helper reads commands from the query string, making it a favored inclusion gadget for turning a local file inclusion into remote code execution.

Deep dive

Learn Article

How to Harden PHP So a File-Inclusion Bug Cannot Reach Code Execution

A file-inclusion bug becomes RCE only when the runtime hands it a gadget and a writable path. A layered set of PHP controls that break that chain, ordered by leverage, so a missed patch survives.

intermediate 4 min read

Back to glossary