Back Sploitus

Exploit for CVE-2026

Sploitus • October 21, 2026

Share: View original

PHP session.upload_progress UAF validation bundle (presumed CVE-2026-109618 / CVE-2026-109619).

Layout: bin/ framework + pocs + trigger, docs/ reports, deltas/ vendor

python3 php_up_framework.py --syms --binary ../deltas/lsphp82-8.2.34-1-bookworm.zval.debug

Known deltas (zval_ptr_dtor - zend_call_function): bookworm 0xc930,

research: Arch&Yuki (@ArchKnight23)

Authorized defensive-research / scoped-engagement use only.

detections/shell-spawned-by-php-worker-linux.yml

detections/shell-spawned-by-php-worker-windows.yml

detections/cve-2026-109618-109619-upload-progress-trigger.yml

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Exploited via php2shell Tool On October 20, 2026, details of two critical heap use-after-free vulnerabilities in PHP, known as php2shell, were leaked prior to coordinated disclosure. The vulnerabilities affect PHP versions 5.4.0 through 8.5.11, with emergency patches released on October 21, 2026. The flaws are triggered by multipart POST requests with the PHP_SESSION_UPLOAD_PROGRESS field, allowing attackers to exploit session upload progress tracking. A proof-of-concept tool named PHP2Shell was leaked alongside the vulnerabilities, leading to predictions of mass exploitation shortly after the patches were released. Researchers confirmed the vulnerabilities, which are critical due to their default exposure in PHP installations. The PHP security team has advised immediate patching to mitigate risks. 10 sources 80

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (2)

CVE-2026-109618 CVE-2026-109619

CWE Weaknesses (1)

CWE-416 - Use After Free

MITRE ATT&CK (2)

T1059 - Command and Scripting Interpreter T1505.003 - Web Shell

Platforms (2)

Tools (2)

Php_up_framework.py Python3