Exploit for Improperly Controlled Sequential Memory Allocation in Php

[![CVE-2026-109618](

[![CVE-2026-109619](

![Python](

![Dependencies](

![License](

**Is your PHP exposed to PHP2Shell?** A zero-dependency, read-only checker for the two critical unauthenticated RCE bugs PHP patched on October 21, 2026.

> Every run in the GIF is real: the checker probing official `php` Docker images.

> This is a **defensive** tool. It contains **no exploit code**, sends **no network traffic**, and only reads your PHP version and ini settings.

Two memory-safety bugs in PHP core, disclosed together (details leaked Oct 20, fixes shipped Oct 21, 2026). Both are rated **CVSS v4.0 9.2** and exploitable by an **unauthenticated remote attacker**. The affected code path dates back to PHP 5.4.

| **CVE-2026-109618** | Out-of-memory hit while request data is only partly initialized; cleanup then trusts that data as valid. |

| **CVE-2026-109619** | Use-after-free: state left over from one request points at freed memory that a later request on the same worker uses. Memory disclosure is also a confirmed impact. |

Every SAPI that serves web requests is in scope: Apache `mod_php` (highest risk), PHP-FPM, `php-cgi`, FrankenPHP, LiteSpeed.

| Branch | Status | Verdict from this tool |

| 8.5 | Fixed in **8.5.12** | `PATCHED` / `VULNERABLE` |

| 8.4 | Fixed in **8.4.27** | `PATCHED` / `VULNERABLE` |

| 8.3 | Fixed in **8.3.36** | `PATCHED` / `VULNERABLE` |

| 8.2 | Fixed in **8.2.35** | `PATCHED` / `VULNERABLE` |

| 7.4 - 8.1 | No official release; minimal source backports published | `BACKPORT-NEEDED` |

| 5.4 - 7.3 | End-of-life, no fix | `EOL-VULNERABLE` |

git clone

./php2shell_check.py # probes the `php` on your PATH

./php2shell_check.py --php /usr/bin/php8.3 # a specific binary

./php2shell_check.py --version 8.4.26 --json # offline, e.g. from an inventory export

--ini memory_limit=-1 --ini session.upload_progress.enabled=0

| `1` | Not patched (vulnerable, backport needed, EOL, or unknown branch) |

| `2` | Error (no PHP found, unparseable version) |

docker run --rm my-app:latest php -r 'echo PHP_VERSION;' \

| xargs -I{} ./php2shell_check.py --version {} || exit 1

`demo/dphp.sh` lets the checker probe PHP inside a container:

IMAGE=php:8.4.26-cli ./php2shell_check.py --php demo/dphp.sh

IMAGE=php:8.4.26-cli PHP_ARGS="-d memory_limit=-1 -d session.upload_progress.enabled=0" \

python3 demo/make_gif.py # regenerate demo/demo.gif (needs Docker + Pillow)

**Patching is the only complete fix.** These settings reduce exposure while you roll out upgrades. The tool shows which are applied when you are not patched.

| CVE-2026-109618 | `memory_limit=-1`, set so applications cannot override it |

| CVE-2026-109619 | `session.upload_progress.enabled=0` |

| CVE-2026-109619 (8.5 only) | `fatal_error_backtraces=0` |

Restart **all** PHP workers afterwards. A container/cgroup memory limit is a useful availability boundary but is not a mitigation by itself. CDN/WAF rules (e.g. Cloudflare's) are a stopgap that only cover traffic routed through them.

- **SAPI ini differs from CLI ini.** The CLI may read a different `php.ini` than PHP-FPM or Apache. Run the checker against each SAPI's binary, or check `phpinfo()` served by that SAPI.

- **Distro packages backport fixes without bumping the version.** Ubuntu, Debian, RHEL, etc. may ship a fixed `8.1.x` that still reports an old version string. Confirm against your vendor's advisory.

- **Beware "PoC" repos.** Exploit code for these CVEs is circulating unverified, and some of it may carry malware. Don't run it.

- [Tenable: PHP2Shell FAQ](

- [Qualys: PHP announces critical security release](

- [Rapid7 ETR](

- [Huntress rapid response](

- [php.net]( - always the authoritative source for versions

MIT. Provided as-is for defensive use; verify findings against official advisories.