In a sea of POC slop, there is one POC out there that works, but it needs certain preconditions. A) PoC limitations - The PoC has some hardcoded values. Easy to fix, but might need adjustments depending on the target. B) Target configuration -> Memory limits: The bug relies on PHP running out of memory while processing a request. Common settings are 128 MB memory and 8 MB POST limits. These can make exploitation harder, but don't guarantee protection. -> Same worker: Both requests must reach the same PHP worker. The first leaves something in memory, and the second picks it up. Different worker, no leftover memory to use. -> Linux (PHP-FPM): Workers are separate processes with their own memory. Hitting the same worker is possible, but not guaranteed. -> Windows (Apache): Multiple threads handle requests within one process. Reaching the same thread can be harder to control. -> Windows (IIS/FastCGI): Separate worker processes, similar to Linux. I'm sure someone will figure it out soon. I'm just trying to explain what I see from my testing.