syhunt / php2shell-protection

# php2shell-protection (PHP 5.2+)
php2shell-protection is a small, generic test kit to check whether an Apache `.htaccess` rule rejects `multipart/form-data` POST requests while allowing ordinary URL-encoded POSTs. No site-specific configuration is included.
## Security context: official PHP security advisory (21 October 2026)
**Critical: patch PHP. This project is an Apache multipart POST filtering and functional testing toolkit, NOT a complete mitigation for either CVE.** PHP officially disclosed two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP installations serving web requests may be affected, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP security team describes the highest risk for mod_php, including a demonstrated attack before application code runs.
| Vulnerability | Official description | Scope of this toolkit |
| --- | --- | --- |
| **CVE-2026-109618** (GHSA-w8hw-w9fx-j79w) | **RCE via out-of-memory (OOM) corruption.** An OOM event can interrupt initialization of internal request data; cleanup may subsequently process invalid data. | Blocking multipart POSTs does **not** address the general OOM vulnerability. |
| **CVE-2026-109619** (GHSA-6wmf-4rv5-p3rp) | **RCE via stale global state.** Request-owned state can remain after its memory is freed and be used by a later request on the same worker. | Session upload progress is one confirmed attack path, but PHP warns there are **other variants**. Blocking multipart POSTs is only a partial control. |
### Official fixed versions and legacy installations
Upgrade to a vendor-patched build, including these upstream fixed releases:
- **PHP 8.2.35** (8.2 reaches upstream end of life on 31 December 2026)
- **PHP 8.3.36**
- **PHP 8.4.27**
- **PHP 8.5.12**
PHP 8.1 and earlier are out of upstream support. Some Linux distributions and LTS vendors may offer backported fixes. The PHP security team also supplied minimal source backports for PHP **7.4, 8.0, and 8.1**. **PHP 5.2 has no upstream patch listed**; move to a maintained runtime or seek an appropriate vendor-supported migration plan. Do not assume that an older runtime is safe because a particular newer feature is absent.
### Separate PHP memory-safety reports and verified SimpleXML regression (21 October 2026)
**These reports are distinct from the php2shell CVEs.** They do not demonstrate that the security fixes for CVE-2026-109618 or CVE-2026-109619 are ineffective.
**Earlier research report (relationship unconfirmed):** A researcher publicly reported an AddressSanitizer-detected double-free in PHP 8.5.12 and clarified that their finding was **not** one of the php2shell vulnerabilities patched on 21 October. The publicly shared crash output alone does not establish remote reachability, code execution, or a CVE assignment. We cannot establish from the available information whether this report describes the same underlying defect as the GitHub issue below.
**Maintainer-verified PHP