Exploit for Improperly Controlled Sequential Memory Allocation in Php

One-shot RCE proof of concept for the PHP `session.upload_progress` use-after-free vulnerabilities.

The exploit chains a heap leak, a libphp leak, and a forged `pDestructor` call to reach `zif_system` — all over plain HTTP against a single `` page, with no authentication and no target-side code.

PHP 5.4.0 through 8.5.11 are affected (14 years of vulnerable code). PHP issued emergency patches on 2026-10-21.

Use this only against systems you own or are authorized to test.

| Field | CVE-2026-109618 (Heap UAF + OOM) | CVE-2026-109619 (Serialize-state UAF) |

|----------------|----------------------------------|--------------------------------------|

| Type | RCE via OOM memory corruption | RCE via stale global state after request |

| Root cause | `longjmp()` after OOM leaves `PS(http_session_vars)` dangling | Worker retains freed request memory across requests |

| Entry point | `session.upload_progress` multipart callback (before RINIT) | SAPI multipart parser / session handler |

| CVSS v4.0 | 9.2 Critical | 9.2 Critical |

| GHSA | [GHSA-w8hw-w9fx-j79w]( | [GHSA-6wmf-4rv5-p3rp]( |

python3 php2shell.py exploit -u

Multi-version Docker labs on `127.0.0.1`. Each lab runs the same prefork config as a drop-in on top of the stock `php:X.Y.Z-apache` image.

0. Worker rotation (prefork child crashes on OOM)

1. Heap leak (`max_input_vars` + `PHPSESSID=\x00` + 12 MB OOM)

2. libphp leak (Set-Cookie out-of-bounds read)

Linux + Apache mod_php prefork ONLY (fork() survival).

Windows / nginx / php-fpm / LiteSpeed / IIS — not supported.

curl -sI | grep X-Powered-By

| Path | Purpose |

|-----------------------------|---------|

| `php2shell.py` | One-shot exploit |

| `docker/docker-compose.yml` | Vulnerable target |

| `docker/apache.conf` | Prefork |

| `docker/offsets.py` | Auto-offset extraction |

| `out/` | Proof + offset cache |

| `profiles/*.json` | Build profiles |

- **9bie** — original public exploit primitive

- **Karasawa2025, WoYinDao, Sansec, devploit, godylockz** — community contributions

- **PHP security team** — patches in 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12

This toolkit does not claim discovery of the CVE.