Exploit for Improperly Controlled Sequential Memory Allocation in Php

These are F5 BIG-IP Advanced WAF configuration checking and protection validation tools for the PHP vulnerability php2shell (CVE-2026-109618/CVE-2026-109619). These tools are used in conjunction with the “php2shell F5 WAF Feature Code Configuration and Validation Guide”. All tools have been tested in the lab (BIG-IP 17.5.1.8, ASU 20261021_191526, PHP 8.3.36 mod_php); testing date: 2026-10-22. > **Note**: The only complete solution is to upgrade PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. WAF configurations can only reduce risks until the upgrade is completed. ## Files

| [`client/php2shell_waf_test_page.html`](client/php2shell_waf_test_page.html) | Browser | Browser testing page. Submit the upload form with the `PHP_SESSION_UPLOAD_PROGRESS` field |

| [`client/php2shell_waf_test.py`](client/php2shell_waf_test.py) | Any computer with Python 3.6+ | Full test: 3 normal requests + 6 attack-related requests, and read the results |

| [`bigip/php2shell_bigip_check.sh`](bigip/php2shell_bigip_check.sh) | BIG-IP (root, bash) | Read-only check: Verify that the 3 signatures exist, and that each policy has been added and enforced |

| [`bigip/irule_php2shell_require_content_length.tcl`](bigip/irule_php2shell_require_content_length.tcl) | BIG-IP virtual server | Optional iRule: Reject POST requests without Content-Length (return code 411) |

| [`lab-backend/index.php`](lab-backend/index.php) | Self-built testing station | Return information the parameters actually received by PHP, to prove whether the request was sent to PHP |

Download all: [main.zip](

| 200204113 | PHP Remote Code Execution | CVE-2026-109619 | Medium |

| 200103697 | PHP Remote Code Execution (2) | CVE-2026-109618 | Low |

| 200204115 | PHP Remote Code Execution (3) | CVE-2026-109618 | Low |

Requires ASU `ASM-AttackSignatures_20261021_191526.im` or a later version. ## How to Use

1. Open `php2shell_waf_test_page.html` with a text editor. 2. Replace the text with the PHP URL protected by the WAF. 3. Open this local file directly in a browser and submit the test. 4. If “The requested URL was rejected” and a Support ID appears, it means the request was blocked. ### 2. curl

curl -s -X POST -F "note=test"

# php2shell feature (CVE-2026-109619): Should be blocked

curl -s -X POST -F "PHP_SESSION_UPLOAD_PROGRESS=waftest" -F "note=test"

python3 client/php2shell_waf_test.py

python3 client/php2shell_waf_test.py --insecure

python3 client/php2shell_waf_test.py --only N1,A1,A2

| N2 | Normal form submission (urlencoded) | Pass |

| A1 | 109619: Multipart with `PHP_SESSION_UPLOAD_PROGRESS` (has value) | Blocked |

| A2 | 109619: Same as above, value is empty | Blocked |

| A3 | 109618: 300 empty file fields | Blocked (requires max parameters check) |

| A4 | 109618: Single part with 300 additional headers | Blocked |

| A5 | 109618: Parameter name nesting depth 70 | Blocked (parameters with `[ ]` should be avoided; generally not recommended for PHP websites) |

| A6 | 109618: Chunked transmission, no Content-Length | Blocked (requires iRule) |

When only 3 signatures are set, the lab tests will block A1, A2, and A4. End code: All meet expectations (return 0), otherwise return 1. ### 4. BIG-IP Unique Check

scp bigip/php2shell_bigip_check.sh root@:/var/tmp/

ssh root@ bash /var/tmp/php2shell_bigip_check.sh

Lab test results (the second policy does not include these 3 signatures):

== 1. Signatures on this system (requires ASU 20261021_191526 or later)

200103697 OK PHP Remote Code Execution (2) (accuracy low)

200204115 OK PHP Remote Code Execution (3) (accuracy low)

200204113 OK PHP Remote Code Execution (accuracy medium)

-- /Common/php2shell_lab_policy mode=blocking vs=/Common/vs_php2shell_lab

-- /Common/awf-lab-policy mode=blocking vs=/Common/vs-awf-http,/Common/vs-awf-https

Other possible statuses: `DISABLED`, `STAGING (only an alarm, not blocking)`, `ENFORCED but no set has “Block”`. These statuses have never appeared in the lab. Execution time: approximately 40 seconds (the lab has 2 policies). ### 5. Self-built testing station (optional)

mkdir -p ~/php2shell-lab/www && cp lab-backend/index.php ~/php2shell-lab/www/

docker run -d --name php2shell_lab -p 8081:80 -v ~/php2shell-lab/www:/var/www/html:ro php:8.3-apache

Then add this host to the BIG-IP pool and test from a virtual server. ## Security Notes

- The test requests only contain attack-related structure characteristics, no attack code, and do not consume memory (each request is only a few KB).

- Only test on systems to which you have permission to test. Test in a production environment during maintenance periods, and notify the monitoring unit first.

- Do not use publicly available PoC tests for testing in a production environment. ## References

- [F5 K000163821](

- [GHSA-w8hw-w9fx-j79w (CVE-2026-109618)](

- [GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)](

- [CISA Alert 2026-10-21](