78ResearchLab / PHP2Shell-Full-Chain-Exploit

# PHP2Shell — Detection & Mitigation Guide
PHP `session.upload_progress` OOM Use-After-Free Remote Code Execution
**CVE-2026-109618 / CVE-2026-109619**
## Vulnerability Summary
| | |
|---|---|
| Type | Use-After-Free (CWE-416) |
| Severity | CVSS v4.0 9.2 (Critical) |
| Auth | None |
| Affected SAPI | All SAPIs serving web requests: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed (highest risk: mod_php) |
| Affected Versions | PHP 5.4.0 ~ 8.5.11 (all branches below the fixed release, see below) |
| Fixed Versions | PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (released 2026-10-21) |
OOM during multipart parsing triggers `longjmp` before `zend_activate_modules()`, leaving `PS(id)` and `PS(http_session_vars)` dangling. The skipped `RSHUTDOWN` lets the pointers survive into the next request, enabling Use-After-Free leading to remote code execution.
### Affected Versions
| Branch | Affected | Fixed In | Support Status |
|---|---|---|---|
| PHP 8.6 (pre-release) | 8.6.0 RC1 ~ RC3 | 8.6.0 RC4 | Pre-release |
| PHP 8.5 | 8.5.0 ~ 8.5.11 | **8.5.12** | Active |
| PHP 8.4 | 8.4.0 ~ 8.4.26 | **8.4.27** | Active |
| PHP 8.3 | 8.3.0 ~ 8.3.35 | **8.3.36** | Security only |
| PHP 8.2 | 8.2.0 ~ 8.2.34 | **8.2.35** | Security only (EOL 2026-12-31) |
| PHP 7.4 ~ 8.1 | All releases | No official release — minimal source backports from the PHP security team | EOL |
| PHP 5.4 ~ 7.3 | All releases | No fix | EOL |
- The vulnerable `session.upload_progress` code path has existed since **PHP 5.4.0**, when the feature was introduced.
- Linux distributions (Debian, Ubuntu, RHEL, AlmaLinux, etc.) often backport fixes without changing the upstream version string. Determine status from the vendor security advisory (USN / DSA / RHSA / ALSA) package version, not `php -v`.
- Official Docker `php` images follow upstream versions; rebuild and redeploy from a fixed tag (e.g. `php:8.4.27-apache`).
- The exploit chain in this repository was verified in a lab against PHP 8.3 ~ 8.5 (default target: 8.4.26).
## Detection Rules
### Snort 2
 [code] 
### Suricata
 [code] 
### Detection Logic
The rules above match traffic satisfying all of the following conditions:
1. `POST` method
2. `Content-Type: multipart/form-data` header
3. Request body contains the `PHP_SESSION_UPLOAD_PROGRESS` field name
`PHP_SESSION_UPLOAD_PROGRESS` is a reserved field name that triggers PHP session upload progress tracking. Legitimate web applications rarely send this field directly, so matching traffic can be classified as a malicious attempt with high confidence.
## Mitigation
> **Updating is the only complete fix.** Per the official PHP advisory, the workarounds below reduce exposure to specific attack paths but do not make an installation safe. Switching SAPI (e.g. mod_php → PHP-FPM) is **not** a mitigation: PHP-FPM is also affected.
### 1. Upgrade PHP (Recommended)
Upgrade to **PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35** (or later). For PHP 8.1 and older, upgrade to a supported branch or apply a vendor/LTS backp