ikow/php2shell-poc

What it is

php2shell-poc is a repository by Qi Deng, dated 21 October 2026, covering CVE-2026-109618 and CVE-2026-109619 in PHP 5.4.0 through 8.5.11. The page describes five independent pre-auth RCE chains (A to E) built on session.upload_progress and the Zend engine's out-of-memory bailout. Only three are public. The summary's "three working exploit chains" is therefore a subset: Chains D and E are offered to paid subscribers of the writeup.

How it works

The page gives mechanism only in one-line labels:

• Chain A: session injection plus local file inclusion.
• Chain B: a use-after-free in var_destroy, leading to a handler overwrite.
• Chain C: a handler mismatch that reaches __destruct.
• Chain D: OOM corruption in the Zend engine core. The author calls it the most critical, with zero-dependency pre-auth RCE against any Apache mod_php install.
• Chain E (PHP-FPM): a producer request to any endpoint that calls session_start() leaves stale BG(unserialize) state. A later request to any PHP endpoint then consumes it, because the rfc1867 upload_progress handler runs during SAPI startup, before application code. The author reports that a script with no session_start() still returned a 502 crash.

Preconditions / Affected

• PHP 5.4.0 (2012) through 8.5.11.
• Chain D needs Apache mod_php. Chain E needs PHP-FPM and one reachable endpoint that calls session_start().
• The author claims 78% of websites are affected, and names WordPress, Joomla, Drupal, Laravel and Magento. This is the author's figure.

What to do

Patch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and later (patch commit 3584a98, 300 files). The page says this is the only complete fix, and that no INI setting fixes the OOM corruption in Chain D.

Interim INI hardening:

session.upload_progress.enabled = Off
session.use_only_cookies = On

Fastest network-level mitigation: block the string PHP_SESSION_UPLOAD_PROGRESS in multipart POST bodies. The author says it has near-zero legitimate use and covers the primary vector for both CVEs.

Detection rules are in detection/: php2shell.rules (Suricata/Snort), php2shell.yaml (Sigma), modsecurity.conf and php2shell.lua (OpenResty/Nginx). The page also links Cloudflare WAF coverage and Corelight Zeek and Suricata rules.

To reproduce in the lab (PHP-FPM, nginx and Apache mod_php in Docker):

git clone https://github.com/ikow/php2shell-poc.git && cd php2shell-poc
cd lab && docker compose up -d
python3 ../poc/verify_session_injection.py --target http://127.0.0.1:18080
python3 ../poc/verify_handler_mismatch.py --target http://127.0.0.1:18080
python3 ../poc/verify_oom_trigger.py --host 127.0.0.1 --port 18081
python3 ../poc/verify_fpm_stale_state.py --target http://127.0.0.1:18080

Treat the exploit scripts as live attack code. Run them only against the lab or systems you are authorized to test.

Caveats

• The poc/ verifiers for Chains D and E check the trigger condition. The working exploits for those chains are not in the repository.
• Disabling session.upload_progress does not close Chain D.
• The page cites Wiz as demonstrating pre-auth RCE on stock container images, but gives no detail beyond a link.
• Advisories listed: GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619).