---

📌 Overview

PHP2Shell refers to a pair of zero-day/critical vulnerabilities discovered in the PHP core engine (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities allow unauthenticated attackers to execute arbitrary code (RCE) on servers running vulnerable configurations of PHP.

   ┌───────────────────────────────┐
   │     Unauthenticated Attacker  │
   └───────────────┬───────────────┘
                   │
                   ▼ 🟣 Exploit Payload
   ┌───────────────────────────────┐
   │   PHP Engine Core Processing  │
   │ (Stream Filters / PHAR Arch)  │
   └───────────────┬───────────────┘
                   │
                   ▼ ⚡
   ┌───────────────────────────────┐
   │   Arbitrary Shell Execution   │
   └───────────────────────────────┘

---

⚡ Vulnerability Details

Parameter	Details
Vulnerabilities	CVE-2026-109618 & CVE-2026-109619
CVSS v4.0 Score	9.2 (Critical)
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
Impact	Unauthenticated Remote Code Execution (RCE)
Affected Software	PHP 5.x, PHP 7.x, PHP 8.0, 8.1, 8.2, 8.3, 8.4

🟣 Threat Breakdowns

1. CVE-2026-109618: Stream Filter Heap Memory Corruption

• Mechanism: Memory safety breach triggered during internal buffer processing inside PHP stream filters.
• Exploit Vector: Manipulation of stream parameters allows an attacker to control memory addresses and achieve code execution.

2. CVE-2026-109619: PHAR Archive Handling Logic Flaw

• Mechanism: Flaw in the parsing and deserialization logic of PHP Archive (.phar) wrappers.
• Exploit Vector: Attacker-controlled header inputs lead to arbitrary function invocation.

---

📸 Demo

---

🛡️ Mitigation & Remediation

1. Upgrade PHP Packages

The most effective fix is to update your server to the latest patched PHP binaries immediately:

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade php8.3-cli php8.3-fpm

# RHEL / CentOS / Rocky Linux
sudo dnf update php

2. Emergency Workarounds (For EOL Environments)

If your application relies on End-of-Life (EOL) versions (e.g., PHP 7.x or 8.0) that do not receive official security patches:

• 🟣 Disable Stream Filters / Dangerous Functions: Edit your php.ini file:

disable_functions = exec,passthru,shell_exec,system,proc_open,popen,phar

• 🟣 WAF / Network Filtering: Implement strict web application firewall (WAF) rules to drop requests containing serialized stream protocols (php://filter/, phar://).
• 🟣 Network Isolation: Isolate legacy servers behind strict internal networks/VPNs.

---

🔍 Detection & Verification

To verify if your server running PHP is potentially vulnerable:

# Check running PHP version
php -v

# Check loaded modules and PHAR settings
php -i | grep -i "phar"

---

🤝 Contributing

Contributions, threat updates, and detection rules (YARA / Sigma) are welcome!

1. Fork the repository
2. Create a feature branch (git checkout -b feature/sigma-rule)
3. Commit your changes (git commit -m 'Add Sigma detection rule')
4. Push to the branch (git push origin feature/sigma-rule)
5. Open a Pull Request

---

📜 Disclaimer

This repository is created purely for educational, defensive, and research purposes. The maintainers are not responsible for misuse or illegal activities performed with the information provided herein.