Researchers Put Together PHP Zero-Day in Order to Hack PornHub
A team of three researchers went so far as to search and discover a PHP zero-day so they could hack PornHub as part of its official bug bounty program.
The path the three took to hack PornHub is something not usually seen in regular security research. Because PornHub servers were somewhat secure from common attack vectors, the researchers were forced to get creative with their attack routine.
What resulted was a zero-day in PHP, the programming language used to power PornHub's website. The issue (CVE-2016-5771/CVE-2016-5773) is a use-after-free vulnerability that occurs when PHP's garbage collection algorithm interacts with other specific PHP objects.
