This repository contains a Python proof-of-concept research tool for two PHP `session.upload_progress` use-after-free (UAF) variants, identified in the script as **CVE-2026-109618** and **CVE-2026-109619**.
The script provides a local self-test, an HTTP endpoint check, and research-oriented execution modes. The underlying issue concerns stale references during multipart upload progress updates. Under vulnerable conditions, memory corruption may lead to process crashes or remote code execution.
> Use this tool **only against infrastructure that you own or are explicitly authorized to assess**. Exploitation attempts can crash PHP workers, disrupt service, or execute operating-system commands. A successful endpoint check does not prove exploitability.
- Network access to an explicitly authorized PHP testing endpoint for remote checks
- No third-party Python packages are required by the provided script
Keep the script at the path `cve_2026_109618.py`, or update the commands below to match its actual filename.
Tests the script's request-body construction and payload structure locally, without contacting a remote endpoint. A passing self-test does **not** establish that a PHP installation is vulnerable.
python cve_2026_109618.py --url --action check
The `check` action inspects any PHP version information disclosed by the endpoint and sends a small multipart request. Replace `victim.tld` with an endpoint you are authorized to test. Results are **indicative**, not definitive proof of vulnerability or safety.
The script also implements an `exec` action for validating command execution in a **controlled lab**:
python cve_2026_109618.py --url --action exec --cmd "id" --dtor 0x51e410
The address shown is an example from the supplied usage, **not a universal or automatically discovered address**. Incorrect memory addresses or build assumptions can crash a PHP worker.
An interactive `shell` action is also available for authorized, isolated testing:
python cve_2026_109618.py --url --action shell
As implemented, this mode requires valid address information before it can confirm execution. It is not equivalent to a conventional persistent shell.
| `--selftest` | Run local construction and structure checks. |
| `--url` | HTTP or HTTPS endpoint to assess. |
| `--action` | Choose `check`, `exec`, `shell`, `build`, or `syms`; default is `check`. |
| `--cmd` | Command string for a supported research action. |
| `--bug` | Choose variant `618` (default) or `619`. |
| `--dtor` | Runtime `zval_ptr_dtor` address, if known. |
| `--call` | Explicit `zend_call_function` address. |
| `--delta` | Build-specific offset between the relevant symbols. |
| `--stall` | Delay between request chunks; default is 1.4 seconds. |
| `--timeout` | Response receive timeout; default is 25 seconds. |
| `--retries` | Attempts per address profile; default is 3. |
| `--sid` | Supply an explicit session identifier. |
| `--insecure` | Disable TLS certificate verification; lab use only. |
| `--binary` | Local PHP binary/debug-symbol path for `syms`. |
| `--out` | Output path for the `build` action. |
- **Self-test passes:** The script's local structural assertions passed; no target was tested.
- **HTTP check completes:** The endpoint accepted or responded to the probe; this is not confirmation of code execution.
- **Version information missing:** Exposure cannot be decided from the HTTP header alone.
- **No command-output marker:** Execution was not confirmed. This does not by itself establish that a system is patched.
- **HTTP 5xx or connection failure:** The worker or service may have failed; stop testing and review the lab's server logs.
Use vendor-supported, security-patched PHP releases, assess whether upload-progress functionality is necessary, and test changes in a non-production environment. Review PHP process logs for crashes or unusual multipart requests. Verify the vendor advisory and the installed package's patch status rather than relying solely on HTTP headers.
The following references are listed in the provided Python source; their claims have not been independently verified for this README.
-
This material is supplied for security research, controlled lab validation, and authorized defensive assessment. The author and contributors are not responsible for unauthorized or harmful use.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
