GitHub - WoYinDao/CVE-2026-109618-CVSS-9.2-Critical: PHP session.upload_progress ...

CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress / multipart parser

Research toolkit for the pre-embargo PHP RCE pair ("PHP2Shell"). Patched 2026-10-21 14:00 UTC — official advisory published.

⚖️ Official Root Cause (advisory, post-patch) — supersedes community narratives

In-the-wild exploitation confirmed before the patch (multipart boundaries literally carrying the CVE IDs are a known IoC). EOL 7.4 / 8.0 / 8.1 have official minimal source backports (self-build).

Patch analysis & our post-patch behavior comparison: docs/PATCH-ANALYSIS.md — includes the finding that the var_destroy reentry UAF is still live on 8.4.27 (independent of both CVEs).

✅ Reproduction Results — honest scope labels

All dynamic verification ran on disposable local labs . Chains A/C are conditional lab constructs : they require an app-side sink/gadget that our lab provides by design — they demonstrate primitives, not blanket "any stock endpoint → RCE".

Errata (credit mallory.ai audit, fixed 2026-10-21): the uaf_trigger.py stall fallback previously sent raw multipart bytes without an HTTP request line/headers — protocol-invalid. The primary single-shot path (source of all arming evidence) was always well-formed; the fallback is fixed.

Errata (credit mallory.ai audit, fixed 2026-10-21): the uaf_trigger.py stall fallback previously sent raw multipart bytes without an HTTP request line/headers — protocol-invalid. The primary single-shot path (source of all arming evidence) was always well-formed; the fallback is fixed.

Windows/Git-bash: prefix docker calls with MSYS_NO_PATHCONV=1 . ASAN builds: use a native WSL distro (Docker-Desktop VM hangs ASAN conftests).

🎯 One-line Root Cause (community-layer summary)

The rfc1867 upload-progress handler runs before RINIT with half-initialized request state ; OOM bailouts and per-request lifetime mishandling leave state that later requests reuse (official CVE core), while the same surface allows unauthenticated session-id/content control (our primitives layer — P1–P5, chains A/C as conditional consequences). Affected-versions note: officially confirmed fixes for 8.2–8.5 ; the community-wide "everything ≥ 5.4" claim traces to the leaked tool's banner and public PoCs, not to an official statement.

🛡️ Defense (aligned with the official position)

Patch now — 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or distro packages). No configuration fully mitigates (PHP team: Girgias "patching is the only mitigation"; 109618 has no safe stopgap).

EOL ≤ 8.1: isolate (VPN/WAF), or self-build the official 7.4/8.0/8.1 backports .

Depth layers (partial): session.upload_progress.enabled = Off + use_strict_mode = On ; uniform serialize_handler across all vhosts; constrain include/require sources; treat every unserialize() input as hostile ( the still-live var_destroy UAF enters here, even on 8.4.27 ).

IoC hunting: multipart boundaries containing CVE-2026-1096 ; shell/compiler/downloader children of php-fpm/httpd; PHP Request Startup: ... in Unknown on line 0 in logs.

Corpus: jackalsyn (corrected read) · ikow · 19h · Zer061 · PHP security team (final advisory). Independent audit of this repo: mallory.ai (stall-path errata accepted & fixed). Authorized research only — all experiments on disposable local labs.

🇨🇳 中文版 README · MIT License