php2shell — CVE-2026-109618 / CVE-2026-109619 Research

Independent security research on the critical PHP session.upload_progress vulnerabilities (CVSS v4.0 9.2).

Author: Qi Deng (@ikow)
Date: 2026-10-21
Full writeup: qideng.substack.com

Overview

Two critical pre-auth RCE vulnerabilities in PHP core's session.upload_progress handler, affecting PHP 5.4.0 through 8.5.x. This repository contains verification POCs and lab setup for authorized security testing.

Verified Attack Chains

Chain	Type	Conditions	Verified
Session File Injection + LFI	Logic bug	upload_progress=On (default) + app LFI	✅ RCE
var_destroy UAF → Handler Overwrite	Memory corruption	unserialize() + /proc/self/mem	✅ ASAN + RCE
Handler Mismatch → __destruct	Deserialization	Cross-dir handler mismatch + POP gadget	✅ RCE

Key Findings

1. Session fixation via POST body bypasses session.use_only_cookies (PR #22113)
2. Unvalidated filename in upload_progress stored raw in session files
3. var_destroy __destruct reentry UAF — ASAN-confirmed heap-use-after-free
4. PS(serializer) not reset in RSHUTDOWN — cross-request serializer leak in FPM
5. __destruct fires on decode FAILURE — object injection via handler mismatch + trailing data

Repository Structure

poc/
  verify_session_injection.py   — Verify filename injection into session files
  verify_uaf_asan.php           — Trigger ASAN heap-use-after-free (var_destroy)
  verify_handler_mismatch.py    — Verify handler mismatch → object deserialization
lab/
  docker-compose.yml            — PHP 8.2.34 FPM + nginx lab environment
  Dockerfile                    — Vulnerable PHP build
  php.ini                       — Lab configuration
  setup.sh                      — One-click lab setup
docs/
  ANALYSIS.md                   — Full technical analysis

Quick Start

# Start the lab
cd lab && ./setup.sh

# Verify session injection
python3 poc/verify_session_injection.py --target http://127.0.0.1:18080

# Verify UAF (requires ASAN build)
docker exec php-asan-lab php poc/verify_uaf_asan.php

# Verify handler mismatch
python3 poc/verify_handler_mismatch.py --target http://127.0.0.1:18080

Affected Versions

• PHP 5.4.0 — 8.5.11 (all versions with session.upload_progress)
• Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (scheduled 2026-10-21)
• PHP 5.x, 7.x, 8.0, 8.1: end-of-life, no official fix

Mitigation

; Immediate mitigation (does NOT fix all attack paths)
session.upload_progress.enabled = Off
session.use_only_cookies = On

Disclaimer

This research is for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit authorization to test.

License

MIT