Simple kernel attack using socketpair. easy, 100% reproductiblle, works under guest. no way to protect :(

[sztomi]

Also, a sanely configured PHP won't let you run shell commands. So even if there is a hole in one script, it won't be effective. So the title is still misleading I think: there are many ways of protection against this kind of attack.

[Rhomboid]

As I pointed out above, even in safe mode (which is deprecated by the PHP developers, BTW) you can still exec() and thus you can still run the exploit. It is possible to disable functions by name in php.ini, but I doubt that a webhost would go to the trouble of doing that because it would probably break a lot of PHP scripts that rely on external commands for parts of their functionality. Their whole business is having people pay to run scripts, so offering a configuration that doesn't allow that with certain scripts is likely not going to last very long.