Exploit for CVE-2026

**CVE-2026-109618** and **CVE-2026-109619**, the pre-authentication use-after-free pair in the

PHP engine disclosed and patched on 2026-10-21.

This repository is **blue-team only**. It contains detection rules and configuration hardening.

It contains **no exploit code, no payload, and no attack procedure**. The detection rules describe

the *structural shape* of hostile traffic — part counts, header lengths, request rates, and the

crash/kill side effects — never a working trigger.

> **The only complete fix is to upgrade and restart.** Move to PHP 8.2.35 / 8.3.36 / 8.4.27 /

> 8.5.12 (or a vendor backport at those CVE fixes) and restart the runtime correctly: PHP-FPM

> reload is enough; **Apache mod_php needs a full restart**; LiteSpeed `pkill lsphp`; FrankenPHP /

> Docker needs a new image; Octane and queue workers must be restarted. Everything here is a

> stopgap or a monitor, not a substitute for patching.

- [`php2shell-defensive-analysis.md`](php2shell-defensive-analysis.md) — the bug class, a

first-hand dissection of the upstream fix, and the detection/remediation rationale.

- [`signatures/`](signatures/) — the deployable kit. See [`signatures/README.md`](signatures/README.md)

for the full index and an order-of-operations.

| `signatures/php2shell-inventory.sh` | Per-host exposure check (exit 2 = exposed); backport-aware |

| `signatures/php2shell-osquery-pack.conf` | Fleet-wide version + deleted-libphp inventory |

| `signatures/php2shell-interim-mitigation.ini` | php.ini / FPM pool hardening while you patch |

| `signatures/php2shell-frontdoor-hardening.conf` | nginx + Apache multipart/rate caps |

| `signatures/php2shell-9200000-multipart.conf` | ModSecurity / Coraza WAF rules (detect-only default) |

| `signatures/php2shell.rules` | Suricata / Snort IDS rules (local SID range 92000000+) |

| `signatures/php2shell_sigma.yml` | Sigma rules: exit-137 kills, SIGSEGV clusters, upload correlation |

| `signatures/php2shell-retrohunt.sh` | Read-only log retro-scan for prior exploitation attempts |

- **All thresholds are tunable, with documented safe defaults.** The real risk of any blocking or

rate-limiting rule here is breaking a legitimate large or multi-field upload. Measure your largest

real upload before tightening a cap, and scope caps to endpoints that actually receive uploads.

- **Dry-run first.** `suricata -T -c /etc/suricata/suricata.yaml` for the IDS rules; `nginx -t` or

`apachectl configtest` for the WAF and front-door configs.

- **Compare package versions, not banners.** Distros backport the fix without bumping the upstream

`x.y.z`, so compare against the per-distro fixed package revision.

Use only on infrastructure you own or are authorized to defend.

- GHSA-w8hw-w9fx-j79w (CVE-2026-109618), GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)

- php-src commit "Avoid state corruption via bailout" (per-branch), shipped 2026-10-21