Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
Critical Advisory (CVSS v4.0: 9.2 - Critical): On October 20, details of two pre-auth Remote Code Execution (RCE) flaws in the PHP core leaked online ahead of coordinated disclosure. Exploitation allows arbitrary command execution straight from the web server.
php2shell refers to two critical vulnerabilities (CVE-2026-109618 & CVE-2026-109619) affecting core PHP functionality. The primary demonstrated vector is a heap use-after-free (UAF) in the PHP core session upload progress mechanism leading to arbitrary code execution (zend_call_function / system()).
PHP's upload progress handler (php_session_rfc1867_callback in ext/session/session.c) stores two raw zval * bucket pointers (post_bytes_processed and current_file_bytes_processed) directly in live HashTable structures.
During request processing:
POST request activates progress tracking with default configuration values (session.upload_progress.enabled = 1).zend_hash_update() destroys the previous data tree using the destructor zval_ptr_dtor, freeing the memory block.zend_fcall_info and zend_internal_function structures.zend_call_function(), resulting in arbitrary system command execution.php-src builds (including versions 8.4.4 and 8.2.34).--syms) between zval_ptr_dtor and zend_call_function to adapt to distribution-specific binary layouts (e.g., Debian Bookworm, Ubuntu Noble, Ubuntu Jammy).The following table summarizes the PHP versions affected by CVE-2026-109618 and CVE-2026-109619, along with their support and patch statuses:
| PHP Branch | Status | Affected Versions | Fixed / Secure Version | Notes |
|---|---|---|---|---|
| PHP 8.5 | Supported (Active) | < 8.5.12 | 8.5.12 | Emergency security release published |
| PHP 8.4 | Supported (Active) | < 8.4.27 | 8.4.27 | Emergency security release published |
| PHP 8.3 | Supported (Active) | < 8.3.36 | 8.3.36 | Emergency security release published |
| PHP 8.2 | Supported (Security Only) | < 8.2.35 | 8.2.35 | Emergency security release published |
| PHP 8.1 | End of Life (EOL) | All 8.1.x versions | No Official Patch (EOL) | Set session.upload_progress.enabled = Off or use ELS/distro backports |
| PHP 8.0 | End of Life (EOL) | All 8.0.x versions | No Official Patch (EOL) | Official support ended; configuration mitigation is mandatory |
| PHP 7.x | End of Life (EOL) | All 7.0 - 7.4 versions | No Official Patch (EOL) | Core ext/session logic vulnerable; urgent mitigation or upgrade required |
| PHP 5.x | End of Life (EOL) | 5.4.0+ (with RFC1867 progress tracking) | No Official Patch (EOL) | Official support ended; isolate host or disable upload progress |
[!WARNING] PHP 8.1 and older End-of-Life (EOL) versions do not receive official security patches from the PHP Foundation. For these environments, immediately apply
session.upload_progress.enabled = Offor rebuild PHP from source using the provided C source patch.
Exploitation of php2shell typically manifests as anomalous child processes spawned directly by PHP worker processes (php-fpm, php-cgi, php-cgi.exe, httpd, apache2).
Monitor and alert on PHP worker processes executing:
/bin/sh, /bin/bash, cmd.exe, powershell.exepython, perlcurl, wget, nc, certutil.exe/dev/tcp/, fsockopen, mkfifowhoami, id, uname -a, ipconfigFor Linux-based web environments without an endpoint detection agent, tools like Florian Roth's free process-watcher can be run in observe mode to flag unusual child process spawning in real time.
php.exe, php-cgi.exe)./tmp, /var/tmp) for dropped webshells or transient execution artifacts.