exploit & detection kit for PHP2Shell (CVE-2026-109618/109619) — exploitation, IOC hunting, Sigma/ModSec rules, recon with PATCHED/VULNERABLE verdicts. Lab-verified. · by @jayy0x01
# php2shell — CVE-2026-109618 / CVE-2026-109619 Lab-Verified Toolkit
Companion bundle to `php2shell-CVE-2026-109618-109619-report.pdf`.
Everything here was executed against an nginx 1.26.3 + PHP-FPM 8.3.32 lab and is
provided **for authorized security testing and defense validation only**.
> **v1.1 — official disclosure (2026-10-21 14:00 UTC).** Patches are live:
> 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Official root cause: stale global state
> (CVE-2026-109619, GHSA-6wmf-4rv5-p3rp) + OOM/longjmp corruption
> (CVE-2026-109618, GHSA-w8hw-w9fx-j79w). The session-lifecycle chains in this
> toolkit map onto the confirmed 109619 session case; official impact is
> broader (no application preconditions; Heartbleed-style memory disclosure).
> Read `php2shell-addendum-A-official-disclosure.pdf` first for the
> finding-by-finding correlation, then the updated mitigation matrix in
> `detection/mitigation-cheatsheet.md` and the official-IOC hunts in
| `php2shell-CVE-2026-109618-109619-report.pdf` | 20-page technical report (verified root cause, chains, recon path, detection pack) |
| `php2shell-addendum-A-official-disclosure.pdf` | Addendum A: correlation with the official GHSA advisories, corrected impact model, merged mitigation matrix, detection upgrades, release-day IR checklist |
| `report-cover.html` | Editable HTML source of the report cover |
| `exploit/exploit_php2shell.py` | Working exploit: `chain-a` (injection+LFI), `chain-a --slow` (cleanup=On race), `chain-c` (handler mismatch), `fixation` probe |
| `exploit/php2shell_uaf_reentry.php` | Chain B evidence: var_destroy reentry UAF (E1 hash reuse, E2 freed-chunk read) |
| `exploit/php2shell_recon.py` | Black-box recon stages 1-5 + chain recommendation |
| `detection/nuclei-php2shell.yaml` | Nuclei exposure template |
| `detection/detection-pack.md` | Log signatures, ModSecurity rules, Sigma rule, patch check |
| `detection/mitigation-cheatsheet.md` | v1.1 merged mitigation runbook (official GHSA guidance + lab notes, incl. the RLIMIT_AS trap) |
| `detection/ioc-hunting.md` | v1.1 hunting playbook for the four official IOCs + retained signatures |
| `lab/` | Rebuildable lab: php.ini, webroot with .user.ini dirs, LFI page, gadget class |
| `evidence/` | Captured outputs for every verification in the report |
# 1. rebuild the lab against any nginx + PHP-FPM pair
sudo bash lab/setup_lab.sh # writes webroot + php.ini into / /z/my-project/lab
python3 exploit/php2shell_recon.py --target
python3 exploit/exploit_php2shell.py --target chain-a --cmd "id"
# 4. Chain A — slow race (cleanup=On default)
python3 exploit/exploit_php2shell.py --target chain-a --slow --cmd "id"
# 5. Fixation primitive (use_only_cookies=1 bypass test)
python3 exploit/exploit_php2shell.py --target fixation
Chain C requires the two-directory topology from the lab (`/app` php_serialize,
`/api` php) and a gadget class defined before decode (opcache.preload in real
targets; the lab uses auto_prepend_file + an application-level
## Verified matrix (PHP 8.3.32 FPM / 8.2.28 CLI, 2026-10-21)
- Chain A slow race vs cleanup=On: RCE confirmed 4/4
- Fixation bypass with use_only_cookies=1: 3/3 session files created
- Chain C: exact decode-failure warning + __destruct -> system() confirmed
- Chain B: nested var_hash reuse + freed-chunk read confirmed (stock build)
Patch fixed versions (released 2026-10-21 14:00 UTC): 8.2.35 / 8.3.36 /
8.4.27 / 8.5.12. EOL branches receive no fix.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
