in function zend_hash_init() int overflow ( ecalloc() )-> heap overflow here segfault in zend_hash_find() but it's possible to fake the bucket and exploit a zend_hash_del_index_or_key i tried a memory dump , just fake the bucked with the pointer of the $GLOBALS's bucket but segfault before in memory_shutdown...