PHP Zero-Days: Pornhub Hack Earned $22K

In 2016, three security researchers discovered two critical PHP vulnerabilities that allowed them to achieve Remote Code Execution (RCE) on Pornhub's servers. Their discovery earned them $22,000 in bug bounty rewards and helped expose serious risks in PHP's object deserialization process.

🔍 What Happened?​

In July 2016, Pornhub announced a $20,000 bug bounty payment to three researchers:

• Dario Weißer (@haxonaut)
• Ruslan Habalov (@evonide)
• Cutz

The researchers discovered two PHP zero-day vulnerabilities:

• CVE-2016-5771
• CVE-2016-5773

Both vulnerabilities involved a Use-After-Free (UAF) memory corruption issue related to PHP's garbage collection mechanism and the unserialize() function.

---

⚙️ How Did the PHP Vulnerabilities Work?​

Both vulnerabilities exploited memory-management problems involving PHP's garbage collector.
The unserialize() function converts serialized data back into PHP values and objects. When an application processes untrusted serialized data, specially crafted input can trigger unexpected behavior.
The two vulnerabilities worked as follows:

Vulnerability	Description
CVE-2016-5771	Use-After-Free in PHP's SPL extension involving SplArray.
CVE-2016-5773	Use-After-Free in the ZIP extension involving the ZipArchive class.

These flaws could allow attackers to execute arbitrary code or crash the application through carefully crafted serialized data.

---

💀 What Could Attackers Do?​

By successfully exploiting the vulnerabilities, the researchers demonstrated Remote Code Execution on Pornhub's servers.
The potential impact included:

• Accessing sensitive server files.
• Reading website database information.
• Exposing source code from co-hosted websites.
• Monitoring user activity.
• Moving deeper into the internal network.
• Potentially escalating privileges to root.

Importantly, these were potential consequences of the demonstrated server compromise, not proof that every possible impact occurred.

---

💰 How Did They Earn $22,000?​

The researchers received rewards from two sources:

Reward Source	Amount
Pornhub Bug Bounty	$20,000
Internet Bug Bounty (HackerOne)	$2,000
Total	$22,000

Pornhub's payment was its first reported bug bounty payout after launching its program in 2016.

---

🛡️ How Were the Vulnerabilities Fixed?​

PHP developers released security fixes in these versions:

• PHP 7.0.8
• PHP 5.6.23
• PHP 5.5.37

The fixes addressed both Use-After-Free vulnerabilities in PHP's SPL and ZIP extensions.

Security lesson: Never blindly pass untrusted, user-controlled data to PHP's unserialize() function.
For applications that need to exchange structured data, JSON is generally a safer choice when PHP object serialization is not required.

---

❓ Frequently Asked Questions​

----------------------

1. What is a PHP Zero-Day vulnerability?​

A PHP zero-day is a security flaw that attackers can exploit before a fix is available or deployed.

2. What does Use-After-Free mean?​

It is a memory-management bug that occurs when a program accesses memory after it has already been freed. This can cause crashes or potentially allow code execution.

3. Are CVE-2016-5771 and CVE-2016-5773 still dangerous?​

They affect old PHP versions. Modern, properly patched PHP versions are not vulnerable to these specific flaws.

4. Is PHP's unserialize() function dangerous?​

It can be dangerous when processing untrusted data. Avoid using it with user-controlled input unless you have a well-designed and secure validation strategy.