CVE-2026-109618 / CVE-2026-109619

Audit of the "php2shell" claims, plus one working local PoC.

中文 · PHP 8.5.4 · lab-only

MITRE: CVE_RECORD_DNE · NVD: no record · php.net: pre-announcement only. This repo audits the technical claims; it does not confirm the identifiers.

30-second verdict

Question	Answer
Can it give a shell?	✅ locally — with an `unserialize()` sink + a `__destruct` gadget
Is that the CVE itself?	⚠️ probably not — the CVE looks like the BG context orphans (note 08)
Is it pre-auth?	❌ the pre-auth path stops at ARM / crash in our tests
Is the leaked bundle right?	❌ `post_bytes_processed` UAF does not reproduce

How the bug flows

multipart POST ──► php_hash_environment()          ← before RINIT
                        │
                        ├─ serialize   encode ──► OOM ──► BG(serialize)   orphaned (64 B)
                        └─ unserialize decode ──► OOM ──► BG(unserialize) orphaned (8208 B)
                        │
                        ▼
              SAPI survives?  ── yes ──► next request reuses the freed context
                        │                        │
                        no                       ├─ Bug S:  crash / leak
                        ▼                        └─ Bug U:  RCE class
                     DoS only

Separate bug used by our PoC:

var_destroy() ──► frees back-ref chunks ──► dtor walk (no serialize_lock)
                                              └─ __destruct ──► inner unserialize ──► R:N reads freed chunk
                                                                   └─ fake closure ──► zif_system(cmd)

Quick start

php exploit/var_destroy_uaf_rce.php "id > /tmp/proof"
cat /tmp/proof        # uid=... gid=...

Needs: vulnerable PHP (8.5.4 verified) · unserialize() on attacker data · a __destruct class · Linux /proc/self/mem · per-build offsets from nm.

Status

Claim	Result
Leaked bundle: `post_bytes_processed` UAF	❌ not reproduced (`Z_TRY_ADDREF`)
Bug S — `BG(serialize)` orphan	⚠️ UAF 3/3 under ASAN · arm reproduced · no RCE
Bug U — `BG(unserialize)` orphan	⚠️ arm reproduced · kill / system not reproduced
var_destroy UAF → RCE	✅ works, 10/10, self-locating
Session poisoning → `include`	✅ reproduced (pre-existing technique)
Handler mismatch → `__destruct`	✅ reproduced (needs a gadget class)
Demo binary offsets	✅ match `8.5.4-0ubuntu1.3` (`delta 0xbe3f0`)

Files

Path	What
`exploit/var_destroy_uaf_rce.php`	self-locating UAF → RCE PoC
`analysis/01-05`	lifetime · ablation · versions · leaked bundle · reachability
`analysis/06`	`BG(serialize)` path + ASAN receipt
`analysis/07`	session poisoning → command execution
`analysis/08`	BG context orphans (re-up package)
`analysis/09`	var_destroy UAF → RCE (offsets, self-locating)
`evidence/`	ASAN traces · OOM logs · binary offsets · runs
`lab/`	build scripts · triggers · matrix · ablation
`PROVENANCE.md`	artifact URLs · dates · hashes

Scope

Local builds, local Apache / php-fpm / Docker labs, and the named Ubuntu package. The PoC runs as the PHP process user; the gadget precondition is real.

Most Popular

CVE-2026-109618-109619-audit