Exploit for Improperly Controlled Sequential Memory Allocation in Php

Non-destructive exposure assessment for **CVE-2026-109619** — the PHP "php2shell"

stale-global-state / use-after-free that leads to unauthenticated remote code

execution (CVSS 9.2, CWE-416 / CWE-824 / CWE-755, advisory `GHSA-6wmf-4rv5-p3rp`).

It fingerprints a PHP deployment, checks whether the running build can possibly

contain the fix, maps the advisory's documented *producer* and *consumer* paths

against the live configuration, and prints a self-contained terminal report with

No exploitation. No OOM trigger. No heap grooming. No payloads.

╭──────────────────────────────────────────────────────────────────────────────╮

│ VULNERABLE │

│ external exploitability: HIGH │

╰──────────────────────────────────────────────────────────────────────────────╯

| `--out DIR` | directory for `--json` / `--save-raw` |

| `--timeout N` | per-request timeout, default 20s |

Colour is automatic: on for a TTY, off when piped. `FORCE_COLOR=1` forces it,

| `0` | `NOT VULNERABLE` — running build is at or above the fixed release |

| `1` | `UNKNOWN` — PHP version not disclosed |

| `2` | `VULNERABLE` — build is in the affected range |

> **VULNERABLE** if the running build cannot contain the fix, i.e. the version is

> below the first patched release for its branch **and** the compile date

> precedes the fix release. **NOT VULNERABLE** if the version is at or above it.

> **UNKNOWN** if the version cannot be determined.

Fixed releases, published 2026-10-21: `8.2.35`, `8.3.36`, `8.4.27`, `8.5.12`.

Older branches (5.4–8.1) are end-of-life with no upstream patch and are reported

Everything else — SAPI, session configuration, size limits, edge filtering — is

reported as a **gate** and as **exploitability**, never folded into a number.

There is no weighted score to argue .

A vendor backport can patch a flaw without bumping the version string. The tool

prints the command that settles it on the host:

Treat `VULNERABLE` as "the observed build predates the fix and should be treated

as unpatched until the package changelog proves otherwise".

E1 running PHP version 8.3.33 /phpinfo.php : PHP Version

E2 vulnerable range 8.3.33 /dev/null

tail -n 200 /var/log/php-fpm/www-error.log

- If `phpinfo()` is not reachable, configuration checks degrade to version

headers and the report marks the unknowns as `N/A` rather than `OK`.

- A version outside the published fixed-version matrix is reported as `WARN`,

- A patched version with an older build date is reported as `NOT VULNERABLE`

with the build date surfaced for manual review.

- Weaknesses: CWE-416 (use after free), CWE-824 (uninitialized pointer),

CWE-755 (improper handling of exceptional conditions)

This tool is for systems you own or have **written permission** to assess. It is

non-destructive by design, but unauthorized scanning may still be illegal in

your jurisdiction. Running it does not create authorization, and a `VULNERABLE`

verdict is not permission to exploit anything. If you find an affected host that

is not yours, report it to the operator or the relevant security team — do not attempt to

The author accepts no liability for misuse or for damage caused by third-party