# Possible Arbitrary Code Execution with Null Bytes (Nginx + PHP)

**URL:** <https://www.ruby-forum.com/t/possible-arbitrary-code-execution-with-null-bytes-nginx-php/211120>\
**Category:** NGINX\
**Created:** [August 26, 2011, 5:05am UTC](https://www.ruby-forum.com/t/possible-arbitrary-code-execution-with-null-bytes-nginx-php/211120 "2011-08-26T05:05:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [August 26, 2011, 5:05am UTC](https://www.ruby-forum.com/t/possible-arbitrary-code-execution-with-null-bytes-nginx-php/211120/1 "2011-08-26T05:05:53Z")

</div>

Hi guys,

Just for your information, there is a security hole that may be  
exploited by  
malicious users, when PHP and older versions of nginx (0.5._, 0.6._,  
0.7 \<= 0.7.65, 0.8 \<= 0.8.37) being used. And it has been widely spread  
these  
days.

This vulnerability was found by Neal Poole and has been reported to  
Igor:  
[https://nealpoole.com/blog/2011/07/possible-arbitrary-code-execution-with-null-bytes-php-and-old-versions-of-nginx/](https://nealpoole.com/blog/2011/07/possible-arbitrary-code-execution-with-null-bytes-php-and-old-versions-of-nginx/)

I do agree with Igor that it’s not an issue of Nginx itself, but those  
lazy  
system administrators should upgrade their Nginx to the latest version  
right

now.

Regards,