GitHub - m0x41nos/TimeAfterFree: PHP 8 Sandbox Escape

A proof-of-concept exploit demonstrating a PHP 8 sandbox escape via a use-after-free vulnerability. The exploit bypasses `disable_functions` restrictions on Unix-like systems by leveraging the `DateInterval` object to leak heap pointers and gain read/write primitives. It affects PHP 8.2.x through 8.5.x and reproduces deterministically across CLI, PHP-FPM, and Apache module environments. The author notes that relying on `disable_functions` as a security boundary is insufficient given PHP's memory-unsafe nature.