ikow / php2shell-poc

php2shell 
 CVE-2026-109618 & CVE-2026-109619 — PHP Pre-Auth RCE Exploit & Detection Toolkit 
 Exploits · Detection · Lab · Writeup 
---
Five independent RCE chains exploiting PHP's `session.upload_progress` and the Zend engine's OOM bailout. **14 years of vulnerable code** — PHP 5.4.0 (2012) through 8.5.11. Pre-auth. No application vulnerability required for some chains.
Impacts **78% of all websites** — including WordPress (43%), Joomla, Drupal, Laravel, Magento, and every default PHP installation.
**Author:** Qi Deng  |  **Writeup:** Substack  |  **Date:** 2026-10-21
## CVE Details
| CVE | GHSA | CVSS | Description |
|-----|------|------|-------------|
| CVE-2026-109618 | GHSA-w8hw-w9fx-j79w | 9.2 | OOM → `longjmp()` leaves Zend engine state invalid → RCE |
| CVE-2026-109619 | GHSA-6wmf-4rv5-p3rp | 9.2 | Stale global state across FPM worker requests → UAF → RCE |
**Patch:** Commit 3584a98 — 300 files changed across the Zend engine.
## Attack Chains
| Chain | Vector | Pre-auth | Conditions | SAPI |
|-------|--------|:--------:|------------|------|
| **A** | Session injection + LFI | Yes | App has any LFI sink | All |
| **B** | var_destroy UAF → handler overwrite | No | App calls `unserialize()` | All |
| **C** | Handler mismatch → `__destruct` | Yes | Two dirs with different serialize_handler | FPM |
| **D** | OOM corruption → stale `EG()` | Yes | **None** — any endpoint | mod_php |
| **E** | FPM session OOM → stale `BG()` | Yes | Producer: any `session_start()` endpoint; Consumer: **any** endpoint | FPM |
Chain D is the most critical: **zero-dependency pre-auth RCE** against any Apache mod_php installation.
Chain E is nearly as broad on FPM: the producer needs any endpoint that calls `session_start()` (near-universal — WordPress, Laravel, Joomla, Drupal all do), and the **consumer can be any PHP endpoint** — the `rfc1867` upload_progress handler runs during SAPI startup before application code. Verified: `nosession.php` (no `session_start()` in code) triggers 502 crash when consuming stale `BG(unserialize)` state.
## Exploits
Three RCE exploits (Chains A, B, C) are included in `exploit/`:
| File | Chain | What It Does |
|------|-------|-------------|
| `chain_a_session_lfi.py` | A | Injects PHP code via upload filename → LFI includes session file → RCE |
| `chain_b_uaf_rce.php` | B | var_destroy UAF → discovers `zif_system` via EG() → overwrites `var_dump` handler via `/proc/self/mem` → RCE |
| `chain_c_mismatch_rce.py` | C | Pollutes FPM worker `PS(serializer)` → injects serialized object via filename → `__destruct` fires on decode failure → RCE |
Chains D and E exploits are available to paid subscribers.
 [code] 
## Detection Rules
Pre-built IDS / WAF / SIEM rules in `detection/`:
| File | Format | Signatures |
|------|--------|-----------|
| `php2shell.rules` | Suricata / Snort | 13 rules — request, response, and recon |
| `php2shell.yaml` | Sigma | 5 rules — web logs, process creation, file events |
| `modsecurity.conf` | ModSecurity v2/v3