devploit / php2shell

# PHP2Shell
**Pre-auth RCE research toolkit for CVE-2026-109618 / CVE-2026-109619**
`exploit by devploit`
*Verified run against the local PHP 8.5.11 laboratory: `uid=33(www-data)`.*
> **Authorized testing only.** Use this material exclusively against systems you
> own or have explicit, written permission to test. It is not a scanning tool,
> it ships no target list, and it must not be used against third-party
> infrastructure. The chain is disruptive: it sends large request bodies,
> triggers pre-RINIT out-of-memory conditions and kills Apache children.
PHP2Shell is a research workspace for the `session.upload_progress` OOM /
stale-pointer chain in PHP's Apache module. It packages a version-aware
dispatcher, a per-build profile engine, reproducible laboratories, a calibration
factory and runtime instrumentation around the public research exploit by
9bie.
The goal is reproducible research and defensive validation, not mass
exploitation. The dispatcher refuses to guess: it stops when the build has no
verified profile, when the target is a fixed release, or when the target OS does
not match the profile.
---
## Status
| Build | Image | Profile | Heap leak | libphp leak | RCE | Notes |
| --- | --- | --- | --- | --- | --- | --- |
| PHP 8.5.11 aarch64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
| PHP 8.5.11 amd64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-amd64` | yes | yes | **yes** | separate offsets, same `htdata` |
| PHP 8.5.10 aarch64 | `php:8.5.10-apache` | `php-8.5.10-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
| PHP 8.4.26 amd64 | `php:8.4.26-apache` | `php-8.4.26-bookworm-amd64` | yes | yes | **yes** | reference build |
| PHP 8.4.25 aarch64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stage 3; retries |
| PHP 8.5.0 aarch64 | `php:8.5.0-apache` | `php-8.5.0-bookworm` | yes | yes | no | stage-3 layout not found |
| PHP 8.3.35 aarch64 | `php:8.3.35-apache` | `php-8.3.35-bookworm-aarch64` | yes | yes | no | stage-3 reference alive |
| PHP 8.3.33 mod_php | `wordpress:7.1.1-apache` | `php-8.3.33-wordpress-mod_php` | yes | yes | no | stage-3 reference alive |
| PHP 8.3.0 aarch64 | `php:8.3.0-apache` | `php-8.3.0-bookworm` | no | no | no | `PS(id)` dangling; cookie not reclaimed |
| PHP 8.2.34 aarch64 | `php:8.2.34-apache` | `php-8.2.34-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
| PHP 8.1.34 aarch64 | `php:8.1-apache` | `php-8.1.34-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
| PHP 8.0.30 aarch64 | `php:8.0-apache` | `php-8.0.30-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
| PHP 7.4.33 aarch64 | `php:7.4-apache` | `php-7.4.33-bookworm-aarch64` | no | no | no | UAF; leak shape differs |
| PHP 8.2.0 aarch64 | `php:8.2.0-apache` | — (offsets only) | n/a | n/a | no | no heap profile |
**13 heap profiles, 5 with verified RCE. Offsets extracted for 12 builds.**
`Heap leak` is stage 1, `li