Exploit for Improperly Controlled Sequential Memory Allocation in Php

> CVE-2026-109618 / CVE-2026-109619 — PHP `session.upload_progress` （Heap Use-After-Free）

| | CVE-2026-109618（OOM ）CVE-2026-109619（） |

| | PHP 5.4.0 – 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 |

PHP （RFC 1867） `session.upload_progress` 。 `php_session_rfc1867_callback()` `zval*` session HashTable `arData` ：

- `session.c:3292` → `post_bytes_processed`

- `session.c:3318` → `current_file_bytes_processed`

`FILE_DATA` `session.upload_progress.min_freq`（ 1 ）， `php_session_rfc1867_update()` → `php_session_initialize()` → `php_session_track_init()`， HashTable（`session.c:236-252`）。。 `session.c:3331-3332` ， UAF 。###

| | nginx + php-fpm | 1.22.1 / 8.4.4-fpm-bookworm |

► Cached zval* pointers were written through (stale path reached)

**“Armed: YES” **：`session.c:3292` `:3318` “”，`:3331-3332` 。。### 3.2

────────────────────────────────────────────────────────────

uid=33(www-data) gid=33(www-data) groups=33(www-data)

────────────────────────────────────────────────────────────

uid=33(www-data) gid=33(www-data) groups=33(www-data)

www-data@php2shell:/var/www/html$ uname -a

Linux 686985b191b8 6.18.54.1-microsoft-standard-WSL2 x86_64 GNU/Linux

www-data@php2shell:/var/www/html$ grep www-data /etc/passwd

www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

1. Heap grooming for precise recovery of the 320-byte slab bin in ZendMM

2. Symbol offsets specific to certain build versions

3. Stable control over reused memory blocks

The details are placed in the undisclosed `WRITEUP.md` archive; they are not available in the public repository.

### 4.2 How does the shell in this repository come ?

The `uid=33(www-data)` process used in this repository takes a **different path**:

Session poisoning (writing PHP code into session files)

FastCGI direct requests, PHP_VALUE=auto_prepend_file=

The index.php file includes the session file before execution → Code executes

**It relies on two additional assumptions:**

- The php-fpm port (9000-9003) is accessible from outside.

- `session.upload_progress` is enabled, and its cleanup timing can be bypassed.

These assumptions may not always hold in a real environment. Therefore, strictly speaking, this chain represents a combination of “PHP dangerous configurations” and “FastCGI exposure,” rather than a single UAF vulnerability. Explaining these two layers separately is what this note aims to emphasize.

Below are the points where issues occurred, recorded in order for others to save time.

Downloading: Windows Subsystem for Linux 3.0.3

Connection to the server was reset ==== 60.1% ===

It wasn’t an interruption; the connection to Microsoft’s server was reset. **Solution**: Download the WSL MSI package from GitHub. Use `Get-AuthenticodeSignature` to verify the Microsoft signature before installation.

### 5.2 `dism` returned 3010, misdiagnosed as a failure

When enabling Windows features, `dism` returns a **3010** instead of 0 when the operation is successful but requires a restart. Using `if errorlevel 1` would misdiagnose 3010 as a failure, but the log actually states “Operation completed successfully”. **Correct method**:

if "%RC%"=="3010" echo OK - REBOOT REQUIRED

if not "%RC%"=="0" if not "%RC%"=="3010" echo FAILED

### 5.3 `wsl --install -d Ubuntu` reported `WININET_E_NAME_NOT_RESOLVED`

Failed to retrieve the distribution list from

Error Code: Wsl/InstallDistro/WININET_E_NAME_NOT_RESOLVED

`--web-download` attempts to fetch the distribution list from `raw.githubusercontent.com`, but the domain resolution fails. **Solution**: Avoid using the online list and manually download the Ubuntu rootfs, then use `wsl --import` to import it.

wsl --import Ubuntu D:\WSL\Ubuntu ubuntu-base.tar.gz --version 2

### 5.4 `ubuntu-base` lacks `ca-certificates`, causing all apt commands to fail

Certificate verification failed: The certificate is NOT trusted.

The minimal rootfile system doesn’t include CA certificates, so HTTPS sources cannot verify them. This is a classic “chicken-or-hat problem”. **Solution**: First, use HTTP sources to install the certificates, then switch back to HTTPS.

sed -i 's| /etc/apt/sources.list.d/ubuntu.sources

apt-get install -y --no-install-recommends ca-certificates

# Then switch back to HTTPS for normal use

### 5.5 The success rate of the FastCGI chain is almost zero

There are two reasons, both of which took a long time to troubleshoot:

**Reason 1: session.uploadprogress.cleanup = On**

After the upload is completed, PHP immediately cleans up the session data. The official script waits for 2 seconds after the upload is finished before triggering the include, by then the session data is already empty. **Result**: Thousands of 0-byte files accumulate in the session directory. **Reason 2: The poison payload missed the prefix**

In `poc.py`, the `poison_payload()` function adds a `x` before the PHP tag:

The explains: “The ‘x’ prefix keeps the variable name parser happy until…”

– Original research: Ahmed Sultan (0x4148)

– PHP official security announcements and `bugs.php.net`

– ZendMM allocator and PHP memory management

This project is **only used for security research, vulnerability testing, and defense hardening**. Users must ensure that:

1. The target system is **owned by them or has written authorization**.

2. The test environment is **networkly isolated from the production environment**.

3. Laws and regulations of the region are followed.

**It is strictly prohibited** to use the content of this project for unauthorized penetration testing, data theft, service disruption, or other illegal purposes. Any direct or indirect consequences resulting from using this project are the responsibility of the user. The author assumes no responsibility. See [DISCLAIMER.md] for the full disclaimer.