A silent, 42-second illustrative and conceptual animation: it contains no real exploit. The on-screen text is in Spanish.
- The setting. On the left, a PHP EHR exposed to the internet; on the right, the attacker's machine.
- Reconnaissance. The attacker targets the server without needing credentials, and the server reveals it runs PHP 8.1, a vulnerable version with no official patch.
- The request. The attacker sends a crafted HTTP request: a multipart form with "upload progress".
- What happens inside PHP. The request exhausts the PHP worker's memory, a value is left half-initialized, cleanup treats it as valid and the attacker controls that value to run code. The bug is in PHP, not in the application: it fires before a single line of the EHR runs.
- Server compromised. The attacker gets a shell with the privileges of the web process, with no username or password. From there they can read everything the EHR can: the patient database, credentials, API keys and clinical data, or install a webshell.
- The fix. With PHP upgraded to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the request no longer corrupts memory and the attack fails. If you are still on PHP 7.x or 8.1, take it off the internet and plan to migrate: there will be no official patch.
- Check your installation today. Inventory every server running OpenEMR, AIOTP or PHP; patch PHP or isolate what cannot be fixed; rotate secrets and look for signs of compromise.
The server, domain and data are fictitious.