Exploit for Improperly Controlled Sequential Memory Allocation in Php

A lightweight Python scanner that checks if a PHP server is affected by the php2shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619) — unauthenticated RCE in PHP's `session.upload_progress` handler.

| CVE-2026-109618 | Out-of-Bounds Memory Corruption | CWE-787 | 9.2 CRITICAL |

| CVE-2026-109619 | Use-After-Free | CWE-416 | 9.2 CRITICAL |

**Affected:** PHP 5.4.0 through all unpatched versions

**Fixed in:** PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12

**No fix available:** PHP 5.4 — 8.1 (end of life)

**All SAPIs affected:** mod_php, PHP-FPM, CGI, LiteSpeed, FrankenPHP

The scanner uses **two detection methods**:

Detects PHP version from HTTP response headers (`X-Powered-By`, `Server`), `phpinfo()` page content, or the local PHP binary (`--local` mode).

### 2. Upload Progress Probe (the key feature)

Many production servers **hide the PHP version** (`expose_php = Off`). This scanner can still detect vulnerability by probing `session.upload_progress`:

- Sends a **normal** multipart POST with a `PHP_SESSION_UPLOAD_PROGRESS` field

- If the feature is enabled, PHP automatically starts a session and returns `Set-Cookie: PHPSESSID=...`

- A server with active `session.upload_progress` is **likely vulnerable** unless patched

**This is NOT exploitation.** It uses [documented PHP behavior]( No memory corruption, no crafted payloads, no malicious data.

The scanner assesses risk level based on:

| mod_php or LiteSpeed | CRITICAL — unauthenticated, pre-application |

| PHP-FPM / CGI | HIGH — exploitable via stale state (CVE-2026-109619) |

| upload_progress = On | Attack vector is active |

| upload_progress = Off | Partial mitigation only (other paths exist) |

| PHP 5.4 — 8.1 | No fix available — must upgrade |

No dependencies — Python 3.6+ standard library only.

git clone

### Scan a remote target (version + probe)

python3 php2shell_scanner.py

### Scan with version check only (no probe)

python3 php2shell_scanner.py --no-probe

python3 php2shell_scanner.py -f targets.txt

python3 php2shell_scanner.py --json

| '_ \| '_ \| '_ \ __) / __| '_ \ / _ \ | |

| |_) | | | | |_) / __/\__ \ | | | __/ | |

| .__/|_| |_| .__/_____|___/_| |_|\___|_|_|

Detection only — no exploitation performed

[!!] PHP unknown version is VULNERABLE to php2shell (CVE-2026-109618 / CVE-2026-109619)

[*] PHP version unknown — but session.upload_progress is active

[*] Server is LIKELY vulnerable unless running a patched version

[*] session.upload_progress.enabled = On — attack vector is active

| 2 | One or more targets are vulnerable |

**Update PHP** to the latest patched version:

PHP 5.4 — 8.1 will **not** receive patches. Upgrade to PHP 8.2+.

**Temporary mitigation** (partial — does NOT fully protect):

Then restart your web server. Note: [Datadog's analysis]( warns this does not protect against all attack paths.

- [CVE-2026-109618 — NVD](

- [CVE-2026-109619 — NVD](

- [JFrog — PHP2Shell Analysis](

- [Rapid7 — Critical RCE in PHP](

- [Datadog — PHP2Shell Detection](

- [PHP Session Upload Progress (docs)](

This tool is provided for **authorized security testing and system administration only**. Only scan systems you own or have explicit permission to test. The author is not responsible for misuse.

GitHub: [@mspiq](