GitHub - eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC: Proof-of

Critical Advisory (CVSS v4.0: 9.2 - Critical): On October 20, details of two pre-auth Remote Code Execution (RCE) flaws in the PHP core leaked online ahead of coordinated disclosure. Exploitation allows arbitrary command execution straight from the web server.

Critical Advisory (CVSS v4.0: 9.2 - Critical): On October 20, details of two pre-auth Remote Code Execution (RCE) flaws in the PHP core leaked online ahead of coordinated disclosure. Exploitation allows arbitrary command execution straight from the web server.

Overview Root Cause Verification & Targets

Verification & Targets

Affected PHP Versions

Threat Landscape & Detection Guidance Behavioral Indicators & Suspicious Child Processes Monitoring Recommendation

Behavioral Indicators & Suspicious Child Processes

Monitoring Recommendation

Action Items for Organizations

Proof of Concept (PoC)

Mitigation & Source Patching 1. Configuration Mitigation (Immediate Stopgap) 2. Automated Quick-Fix Script 3. Source Code Patch ( session-upload-progress-counters.patch ) 4. Cloudflare WAF Custom Rules 5. FrankenPHP Caddyfile Configuration 6. Lighttpd Configuration 7. Apache Mitigation (ModSecurity & .htaccess)

1. Configuration Mitigation (Immediate Stopgap)

2. Automated Quick-Fix Script

3. Source Code Patch ( session-upload-progress-counters.patch )

4. Cloudflare WAF Custom Rules

5. FrankenPHP Caddyfile Configuration

6. Lighttpd Configuration

7. Apache Mitigation (ModSecurity & .htaccess)

php2shell refers to two critical vulnerabilities (CVE-2026-109618 & CVE-2026-109619) affecting core PHP functionality. The primary demonstrated vector is a heap use-after-free (UAF) in the PHP core session upload progress mechanism leading to arbitrary code execution ( zend_call_function / system() ).

Severity: Critical (CVSS v4.0: 9.2)

Impacted Versions: Reports indicate PHP versions 5, 6, 7, and 8 may be affected. Fixes are primarily expected for currently supported PHP 8 branches, leaving end-of-life (EOL) versions (PHP 5.x, 7.x, 8.0, 8.1) exposed without official vendor patches.

Industry Tracking: Confirmed by security researchers (watchTowr reproduced CVE-2026-109618; monitoring by Huntress and Florian Roth / process-watcher).

PHP's upload progress handler ( php_session_rfc1867_callback in ext/session/session.c ) stores two raw zval * bucket pointers ( post_bytes_processed and current_file_bytes_processed ) directly in live HashTable structures.

During request processing:

Trigger: A standard multipart POST request activates progress tracking with default configuration values ( session.upload_progress.enabled = 1 ).

Free: A progress update cycle re-reads session data. The function zend_hash_update() destroys the data tree using the destructor zval_ptr_dtor , freeing the memory block.

Reclaim: The freed bucket memory is reclaimed. The dangling pointer is redirected to crafted zend_fcall_info and zend_internal_function structures.

Execution: PHP calls zend_call_function() , resulting in arbitrary system command execution.

Verification & Targets

Confirmed on standard php-src builds (including versions 8.4.4 and 8.2.34).

Uses symbol offsets ( --syms ) between zval_ptr_dtor and zend_call_function to adapt to distribution-specific binary layouts (e.g., Debian Bookworm, Ubuntu Noble, Ubuntu Jammy).

Affected PHP Versions

The following table summarizes the PHP versions affected by CVE-2026-109618 and CVE-2026-109619 , along with their support and patch statuses:

PHP 8.1 and older End-of-Life (EOL) versions do not receive official security patches from the PHP Foundation. For these environments, immediately apply session.upload_progress.enabled = Off or rebuild PHP from source using the provided C source patch.

Threat Landscape & Detection Guidance

Exploitation of php2shell typically manifests as anomalous child processes spawned directly by PHP worker processes ( php-fpm , php-cgi , php-cgi.exe , httpd , apache2 ).

Behavioral Indicators & Suspicious Child Processes

Monitor and alert on PHP worker processes executing:

Interactive Shells: /bin/sh , /bin/bash , cmd.exe , powershell.exe

Script Interpreters: python , perl

Network / Transfer Utilities: curl , wget , nc , certutil.exe

Common Reverse Shell Patterns: /dev/tcp/ , fsockopen , mkfifo

Immediate Reconnaissance Commands: whoami , id , uname -a , ipconfig

Monitoring Recommendation

For Linux-based web environments without an endpoint detection agent, tools like Florian Roth's free process-watcher can be run in observe mode to flag unusual child process spawning in real time.

Action Items for Organizations

Inventory All PHP Environments: Public-facing web servers running applications like WordPress, Drupal, Joomla, or Magento. Internal appliances, hosting panels (cPanel, Plesk), and bundled standalone binaries ( php.exe , php-cgi.exe ).

Public-facing web servers running applications like WordPress, Drupal, Joomla, or Magento.

Internal appliances, hosting panels (cPanel, Plesk), and bundled standalone binaries ( php.exe , php-cgi.exe ).

Prepare for Patch Windows: Official emergency patches from PHP and downstream Linux distributions are scheduled for release around Wednesday, October 21 at 14:00 UTC (10:00 AM ET) . Apply vendor updates immediately once released.

Official emergency patches from PHP and downstream Linux distributions are scheduled for release around Wednesday, October 21 at 14:00 UTC (10:00 AM ET) .

Apply vendor updates immediately once released.

Isolate End-of-Life (EOL) Installations: Environments running unsupported versions (PHP 5.x, 7.x, 8.0, 8.1) may not receive official upstream backports. Restrict access via VPN, apply strict WAF rules, or disable public internet exposure.

Environments running unsupported versions (PHP 5.x, 7.x, 8.0, 8.1) may not receive official upstream backports.

Restrict access via VPN, apply strict WAF rules, or disable public internet exposure.

Incident Response & Investigation: If suspicious child processes or unexpected files are detected, isolate the host and preserve web server/PHP logs. Inspect web roots and temporary directories ( /tmp , /var/tmp ) for dropped webshells or transient execution artifacts.

If suspicious child processes or unexpected files are detected, isolate the host and preserve web server/PHP logs.

Inspect web roots and temporary directories ( /tmp , /var/tmp ) for dropped webshells or transient execution artifacts.

Proof of Concept (PoC)

This repository is dedicated to security research and Proof-of-Concept (PoC) development for php2shell (CVE-2026-109618 / CVE-2026-109619) .

The PoC exploit is currently being developed and tested. The code will be published in this repository very soon.

⭐ Star this repository to stay updated on the upcoming PoC release.

Mitigation & Source Patching

Until official vendor packages are updated in your repositories, you can protect your environments using configuration changes, automated scripts, or by compiling PHP with the included source patch.

1. Configuration Mitigation (Immediate Stopgap)

The vulnerability relies on PHP's session upload progress mechanism ( session.upload_progress.enabled ), which is enabled by default. Disabling this directive neutralizes the attack vector while preserving regular file upload functionality:

Or for PHP-FPM pool configurations (e.g., /etc/php/*/fpm/pool.d/ ):

After modifying the configuration, reload/restart your web services (e.g. systemctl reload php-fpm or systemctl reload apache2 ).

2. Automated Quick-Fix Script

A mitigation helper script is available under the quick-fix/ directory:

Check Current Status: sudo ./quick-fix/run.sh --check

Apply Mitigation (Dry Run): sudo ./quick-fix/run.sh --dry-run

Apply Mitigation: sudo ./quick-fix/run.sh

Revert Changes: sudo ./quick-fix/run.sh --revert

3. Source Code Patch ( session-upload-progress-counters.patch )

If you build PHP from source or maintain custom distribution packages, a C-level source patch is provided under patch/session-upload-progress-counters.patch .

What the patch fixes: The patch resolves the root cause in ext/session/session.c and ext/session/php_session.h . Instead of maintaining vulnerable, raw zval * bucket pointers ( post_bytes_processed and current_file_bytes_processed ) into dynamic HashTable structures (which become dangling pointers when the hash table is cleared or re-allocated during upload progress updates), the patch:

Stores counters as direct zend_long primitives.

Introduces php_session_rfc1867_sync_counters() to safely resolve and update array entries without dangling references.

How to Apply the Patch:

Navigate to the root of your php-src source directory: cd /path/to/php-src

Navigate to the root of your php-src source directory:

Test applying the patch (dry-run): # Using git (if building from a git clone) git apply --check /path/to/patch/session-upload-progress-counters.patch # OR using GNU patch patch -p1 --dry-run make -j " $( nproc ) " sudo make install

Recompile and install PHP:

Restart your PHP runtime / web services: sudo systemctl restart php-fpm # or sudo systemctl restart apache2

Restart your PHP runtime / web services:

4. Cloudflare WAF Custom Rules

Recommended Cloudflare WAF rule templates to filter malicious traffic are located in the cloudflare-rule-fix/ directory:

Comprehensive multipart blocking (excluding legitimate upload routes)

Enterprise plan PHP_SESSION_UPLOAD_PROGRESS request body inspection

Note: Blocking requests based solely on the PHPSESSID cookie is strongly discouraged as it breaks valid user sessions. Refer to cloudflare-rule-fix/README.md for full rule syntax and details.

5. FrankenPHP Caddyfile Configuration

To disable the session upload progress mechanism globally in FrankenPHP environments, a Caddyfile snippet is provided.

Add the contents of frankenphp/Caddyfile-snippet to your global Caddyfile block:

6. Lighttpd Configuration

For environments running Lighttpd, you can block multipart requests ( POST , PUT , PATCH ) on virtual hosts or directories that do not accept file uploads using lighttpd/php2shell.conf :

7. Apache Mitigation (ModSecurity & .htaccess)

Two mitigation options are provided for Apache environments:

ModSecurity Rule: Block requests containing the PHP_SESSION_UPLOAD_PROGRESS parameter using apache/modsecurity-php2shell.conf : SecRequestBodyAccess On SecRule ARGS_NAMES "@streq PHP_SESSION_UPLOAD_PROGRESS" \ "id: 1026109618 ,phase: 2 ,t:none,deny,status: 403 ,log,\ msg:'php2shell: PHP_SESSION_UPLOAD_PROGRESS field blocked (CVE- 2026 - 109618 / 109619 )'"

ModSecurity Rule: Block requests containing the PHP_SESSION_UPLOAD_PROGRESS parameter using apache/modsecurity-php2shell.conf :

.htaccess / mod_rewrite Rule: For directories that do not require file uploads, block multipart requests before they reach the PHP interpreter using apache/.htaccess : RewriteEngine On RewriteCond %{REQUEST_METHOD} ^(POST|PUT|PATCH)$ [NC] RewriteCond %{HTTP:Content-Type} ^[[:space:]]*multipart/form-data([;,[:space:]]|$) [NC] RewriteRule ^ - [F,L]

.htaccess / mod_rewrite Rule: For directories that do not require file uploads, block multipart requests before they reach the PHP interpreter using apache/.htaccess :

This project is intended strictly for educational purposes and authorized security research. Use only in environments you own or have explicit permission to test.