. It runs **on the host you
own** and tells you whether that host is exposed, with proof rather than a
The advisory says "PHP 5.4 through 8.1, and unpatched 8.2/8.3/8.4." That is not
an answer a sysadmin can act on. Real fleets mix SAPIs, per-pool `php.ini`
overrides, containers built from three different base images, and a `php -v` on
the CLI that says nothing what FPM is actually running.
This tool asks the questions that decide exposure:
1. Is the PHP build in the affected range?
2. Is `session.upload_progress.enabled` actually on for this SAPI?
3. Does an unauthenticated multipart request carrying
`PHP_SESSION_UPLOAD_PROGRESS` actually cause a session file to be written?
Question 3 is the one that matters. It is the precondition for the UAF, and it
No exploitation. No heap grooming, no crash attempt, no shell. The probe sends
one ordinary multipart upload and then looks in the session directory for the
marker it planted. If the file is there, the write path is reachable — that is
the finding. Nothing is corrupted, nothing is executed.
The probe refuses any host that is not `127.0.0.1`, `localhost`, or `::1`
unless you pass `--allow-remote`, and that flag exists for auditing your own
curl -O
php2shell-check — CVE-2026-109618 / CVE-2026-109619
----------------------------------------------------------
Version verdict : exposed (PHP = fixed release -> PATCHED (0)
session.upload_progress.enabled = 0 -> MITIGATED (0)
file_uploads = 0 -> MITIGATED (0)
affected + progress on + probe proved write -> EXPOSED (1)
affected + progress on + probe unproven -> AT RISK (2)
version undeterminable -> INCONCLUSIVE (3)
Fixed releases: **8.1.32, 8.2.25, 8.3.14, 8.4.2**. PHP 5.x is EOL and will
never receive a fix — it stays `exposed` by construction.
The tool reads state from the **CLI SAPI** of the binary you point it at with
`--php`. FPM pools frequently override `php.ini` per pool, and a container may
For an FPM host, confirm the pool's actual values:
php-fpm8.3 -tt 2>&1 | grep -i upload_progress
or read the pool config directly. If the CLI and the pool disagree, the pool
1. Upgrade to 8.1.32 / 8.2.25 / 8.3.14 / 8.4.2 or later.
2. Interim: `session.upload_progress.enabled=0` in the effective `php.ini`,
then reload FPM. Upload progress bars stop working; nothing else does.
3. If progress display is a product requirement, reject
`PHP_SESSION_UPLOAD_PROGRESS` in multipart bodies from unauthenticated
Verified end to end on PHP 8.3.13 (`php -S`, `session.upload_progress.cleanup=0`)
— probe planted a marker, session file located at
`/tmp/probe-test/sess3/sess_`, excerpt captured showing the serialized
`upload_progress_|a:5:{...}` payload. Verdict `EXPOSED`, exit 1.
Not yet verified against PHP-FPM. If you run it on an FPM host and the result
differs from what the pool config implies, that is a bug — open an issue.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
