Is4yev / php2shell-poc

# CVE-2026-109618 / CVE-2026-109619 — PHP2Shell PoC
> **Critical PHP Heap Use-After-Free — CVSS 9.2** 
> Affects PHP 5.x through 8.x (PHP 7.4 is EOL — no patch will ever be released)
## Overview
**PHP2Shell** is the name given to two heap use-after-free vulnerabilities in PHP core
patched on October 21, 2026.
| CVE | Component | Trigger |
|-----|-----------|---------|
| CVE-2026-109618 | `session.upload_progress` handler (rfc1867) | Requires `session.upload_progress.enabled = On` (default since PHP 5.4) |
| CVE-2026-109619 | Multipart parser | Any `multipart/form-data` POST — no session required |
Both are rated **CVSS 9.2** and affect unauthenticated attackers on any PHP installation
serving multipart requests.
## How It Works
### Root Cause
The `rfc1867` upload-progress handler in `ext/session/session.c` caches raw C pointers
into the live session HashTable:
 [code] 
When a **concurrent request** with the same `PHPSESSID` calls `session_start()`,
the session module reinitializes — **freeing the old HashTable** — while the
upload-progress handler still holds raw pointers into it.
Any further `FILE_DATA` write events go through those **stale (dangling) pointers**
into freed memory: a classic heap use-after-free write primitive.
 [code] 
### CVE-2026-109619 — Multipart Parser
A second UAF sits in the multipart parser itself (`main/rfc1867.c`).
It fires for **every** `multipart/form-data` POST — session handling not required.
This makes it reachable against any PHP endpoint, including login forms,
file upload handlers, and REST APIs.
---
## php2shell.py — Multi-chain RCE Exploit
`php2shell.py` is a comprehensive exploit tool that automatically selects the best
attack chain for a given target.
### Chains
| Chain | Technique | Requirements |
|-------|-----------|--------------|
| `uaf` | Heap UAF spray (precise or blind) | `session.upload_progress.enabled=On` |
| `aslr-leak` | HTTP-only ASLR bypass: heap + libphp pointer leak → precise UAF | PHP 8.x prefork mod_php, `display_errors=On`, `memory_limit=8M` |
| `session-lfi` | Session upload_progress poison → LFI file include | upload_progress + LFI param on target |
| `log-poison` | User-Agent PHP inject → Apache access log → LFI include | Apache access log readable via LFI |
| `jce` | CVE-2026-48907: JCE [stall_seconds]
# HTTPS target
python3 splat.py target.example.com 443 /index.php 0.35
 [code] ini
; php.ini — disables CVE-2026-109618 vector only
session.upload_progress.enabled = Off
```
For CVE-2026-109619 (multipart parser), the only real fix is patching.
At the web server level, blocking `Content-Type: multipart/form-data` for
endpoints that don't need file uploads reduces attack surface but is not
a complete mitigation.
## Disclaimer
This PoC is published for **educational and authorized security testing** only.
Unauthorized use against systems you do not own or have explicit written permission
to test is illegal. The crash induced by `splat.py` causes a single PHP-FPM worker
to die; PHP-FPM re