Skip to content
Exploit for Improperly Controlled Sequential Memory Allocation in Php

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Sploitus • October 23, 2026

**Defensive research and tooling for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)** - two critical memory-safety vulnerabilities in the PHP engine disclosed with the PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 security releases (2026-10-21).

![python]( ![license]( ![scope](

> **Defensive only.** No exploit code is included. The goal is to help engineers *understand*, *detect* and *remediate* this bug class.

PHP2Shell is a textbook case of a hard-to-see bug class: **a request that dies at the wrong moment (out-of-memory bailout) leaves stale or half-initialized state that the engine later trusts**, in workers that live across many requests. This repository turns that into:

1. a clear, source-graded **technical analysis** ([docs/](docs/)),

2. a tested **config auditor and log triage CLI** (`p2sdefense`),

3. deployable **detection content** (ModSecurity, Sigma, Falco, auditd) and **hardening configs**,

4. a safe **C teaching lab** that reproduces the bug *class* under AddressSanitizer,

git clone && cd php2shell-defense-kit

p2sdefense version 8.3.35 # -> [VULNERABLE] 8.3.35 < 8.3.36 ...

# Audit your real config (files or directories, repeatable)

p2sdefense audit -c /etc/php/8.3/fpm/php.ini -c /etc/php/8.3/fpm/pool.d/ --php-version 8.3.35

p2sdefense audit -c /etc/php/8.3/fpm/ --php-version 8.3.35 --format json --fail-on 3 # CI-friendly

# Triage logs (weak indicators; see docs/06 for limits)

p2sdefense scan-access /var/log/nginx/access.log

p2sdefense scan-errors /var/log/php8.3-fpm.log --burst 5

pytest # 43 tests

make -C lab/stale-pointer-demo run-vulnerable # AddressSanitizer catches the dangling pointer

make -C lab/stale-pointer-demo run-fixed # clean

[CRIT] P2S-001 PHP version is exposed to PHP2Shell

[HIGH] P2S-002 session.upload_progress is enabled

[HIGH] P2S-003 Finite memory_limit keeps the OOM bailout reachable

why : Both CVEs are triggered by a fatal out-of-memory bailout skipping cleanup...

fix : Until patched: memory_limit = -1 (locked) plus an external memory cap. Best fix: upgrade PHP.

- **Patch-aware auditing.** Severity depends on whether PHP is fixed. After patching, the tool tells you to *remove* the interim `memory_limit=-1` instead of demanding it forever. Unknown version fails safe (assumes unpatched).

- **Understands PHP config semantics.** Distinguishes `php.ini` / `php_admin_value` (locked) from `php_value` / `.user.ini` (overridable), and resolves precedence like PHP-FPM does.

- **Honest scope.** Every rule states *why* it exists; every doc states confidence and limits. See [docs/06](docs/06-limitations-and-methodology.md).

- **Zero runtime dependencies** (stdlib only), typed, unit-tested, CI on multiple Python versions plus a C sanitizer job.

| `src/p2sdefense/` | CLI + libraries: `version`, `iniparse`, `audit`, `logscan`, `cli` |

| `tests/` | 43 pytest tests (logic, CLI, rule-file validation) |

| `rules/modsecurity/` | WAF signatures with anomaly scoring |

| `rules/sigma/` | Vendor-neutral SIEM rules (process lineage, crash bursts, web indicators) |

| `rules/falco/`, `rules/auditd/` | Runtime/EDR-style detection |

| `hardening/` | `php.ini`, FPM pool, systemd cgroup cap, Docker snippet |

| `lab/stale-pointer-demo/` | C model of the bug class, ASan-verified |

| `docs/` | Architecture, vulnerability analysis, patch analysis, defense-in-depth, IR playbook, limitations, learning path, references |

1. [Engine architecture & memory lifecycle](docs/01-engine-architecture.md)

2. [Vulnerability analysis](docs/02-vulnerability-analysis.md)

3. [Patch analysis](docs/03-patch-analysis.md)

4. [Defense in depth](docs/04-defense-in-depth.md)

5. [Incident response playbook](docs/05-incident-response-playbook.md)

6. [Limitations & methodology](docs/06-limitations-and-methodology.md)

7. [Learning path](docs/07-learning-path.md)

| Vulnerability research & source triage (conflicting sources, confidence grading) | `docs/02`, `docs/06` |

| Memory-safety / C systems understanding (UAF, `longjmp`, arenas, ASan) | `lab/`, `docs/01`, `docs/03` |

| PHP internals (Zend MM, request lifecycle, FPM/`mod_php` behaviour) | `docs/01`, `src/p2sdefense/audit.py` |

| Detection engineering (WAF, Sigma, Falco, auditd; FP/evasion analysis) | `rules/`, `docs/04` |

| Secure configuration & compensating controls | `hardening/`, `docs/04` |

| Software engineering (typed Python, tests, CI, packaging, CLI design) | `src/`, `tests/`, `.github/` |

| Responsible research (no weaponization, limits stated) | `SECURITY.md`, `docs/06` |

Written within a day of disclosure from public vendor analyses; the official GHSA text and patch diffs were not independently reviewed (see docs). Contributions that verify or correct claims are welcome - see [CONTRIBUTING.md](CONTRIBUTING.md).