Anton-Barinov / php2shell-patches

# php2shell patches — CVE-2026-109618 / CVE-2026-109619 for old PHP (5.6–8.1) & OpenCart / HestiaCP
Emergency backports and hardening for **CVE-2026-109618** and **CVE-2026-109619**
("php2shell") — two critical unauthenticated RCE vulnerabilities in PHP,
CVSS v4.0 **9.2**. Fixed upstream 21 Oct 2026 (PHP 8.5.12 / 8.4.27 / 8.3.36 /
8.2.35). **PHP 5.6, 7.x, 8.0, 8.1 are EOL and get no official fix** — this
repo packages EOL backports (official + community) plus emergency hardening
for legacy stacks: **OpenCart, WordPress, Drupal, Joomla, Magento**, any
HestiaCP / VestaCP / cPanel host still running old PHP.
> **There is no complete mitigation. Updating to a fixed release (or applying
> a real patch below) is the only safe choice.** Hardening alone only blocks
> known attack paths and buys time.
---
## Two patch flavors — pick your trade-off
| | **minimal** (official PHP-group) | **enhanced-universal** (community) |
|---|---|---|
| Fixes CVE-2026-109618 (OOM → RCE) | ✅ | ✅ |
| Fixes CVE-2026-109619 (upload_progress UAF) | ✅ by **disabling** upload_progress | ✅ by **fixing the root cause** (counters as `zend_long`, no dangling `zval*`) |
| `multipart/form-data` file uploads | ✅ work | ✅ work |
| Session upload **progress bar** | ❌ disabled | ✅ **still works** |
| Blocks session-fixation via POST body | ❌ | ✅ (PR #22113) |
| Sanitizes filename in session file (LFI / handler-mismatch) | ❌ | ✅ |
| Resets `PS(serializer)` between FPM requests | ❌ | ✅ |
| Officially blessed by PHP Group | ✅ (7.4/8.0/8.1 branches) | ❌ (community, but combines official OOM fix + root-cause UAF fix) |
**Rule of thumb:**
- Want the safest, most conservative fix and don't care about upload
 progress bars → **minimal**.
- Need working forms / progress bars (e.g. OpenCart admin product forms,
 large file uploads) and want the extra fixation/filename/serializer
 fixes → **enhanced-universal**.
Both keep normal `multipart/form-data` POST parsing intact — product forms,
image uploads, category edits, etc. all continue to work. The only functional
difference is whether the optional session-based upload-progress tracker
stays enabled.
---
## Which fix do you need?
| Your PHP | Official fix? | What to do |
|---|---|---|
| 8.5.x The enhanced patch does **not** close the `var_destroy`
> unserialize UAF (Chain B in ikow's research) — it is only reachable if
> the application exposes `unserialize()` to attacker data. Update to a
> fixed PHP release to close that path completely.
---
## How to apply
### A. Supported branch (8.2–8.5) — just update
 [code] 
### B. PHP 7.0 / 7.1 / 7.2 / 7.3 / 7.4 / 8.0 / 8.1 — build patched
 [code] 
Then switch HestiaCP FPM pools / templates to the new binary, or install
alongside system PHP and migrate domains one at a time.
**Run `make test` before production.**
### B2. In-place swap over the distro PHP (drop-in replacement)
Replacing the distro binaries themselves (`/usr/bin/phpX.Y`,
`/usr/sbin/php-fpmX.Y`, `/usr/bin/php-cgiX.Y` while keeping the packaged