Universal PHP RCE exploit for **CVE-2026-109618** and **CVE-2026-109619** (php2shell).
Pre-auth, cookie-less, pure-HTTP remote code execution against PHP's `session.upload_progress` handler. Exploits a use-after-free in session handling that leaves dangling pointers after OOM bailout, enabling heap-based ASLR bypass and function pointer overwrite.
**This tool is for authorized security testing, research, and education ONLY.**
- Only use against systems you own or have explicit written permission to test
- Unauthorized access to computer systems is illegal in most jurisdictions
- The authors are not responsible for any misuse of this tool
- Always follow responsible disclosure practices
--target \
python3 recon.py
A1: OOM during END cleanup → dangling PS(id) + PS(mod_data)
├─ Nested file fields + fillers exhaust memory_limit
└─ php_url_encode OOM leaves stale session pointers
├─ Fake zend_string header at stale ID address
├─ php_url_encode reads ~800KB past string boundary
├─ zval_ptr_dtor appears ~1095x → libphp base
└─ 2MiB-aligned pointer clusters → main chunk base
A2: Cheap OOM → dangling PS(http_session_vars)
└─ Similar to A1 but targets different pointer
├─ Spray fake zend_references pointing to fake zend_array
└─ zend_hash_destroy at shutdown calls system(cmd)
exploit.py Main entry point (pipeline orchestrator)
recon.py Target fingerprinting (standalone or imported)
├── transport.py HTTP transport (chunked, plain, GET; proxy support)
├── payloads.py Multipart payload builders (A1, B1, fake HashTable)
├── leak.py OOB leak parser + pointer analysis
├── forge.py B2 fake-reference spray
├── calibrate.py Auto-calibration (OOM probe, memory limit detection)
├── offset_db.py Profile database with fuzzy matching
├── offsets.py ELF symbol offset extraction
└── worker_pin.py Worker pinning by connection saturation
profiles/ JSON profiles for known PHP builds
docker/ Lab setup (Dockerfile, configs)
from lib.offsets import extract_from_container
z, d = extract_from_container('container-name')
z, d = extract_from_elf('/path/to/libphp.so')
Save as `profiles/php-X.Y.Z-os-arch.json`:
; Immediate mitigation — add to php.ini and restart workers
Or patch PHP to 8.4.27+ / 8.3.36+ / 8.2.35+ / 8.5.12+.
On Apple Silicon Macs, Docker Desktop may require:
export DOCKER_HOST=unix:///Users/$(whoami)/.docker/run/docker.sock
Native ARM64 images are pulled automatically. The exploit supports both x86_64 and aarch64 pointer ranges.
- [Sansec — PHP2Shell research](
- [Red Hat CVE-2026-109618](
- [9bie/php2shell-bypass-aslr-exp]( — Original ASLR bypass research
MIT — For authorized security testing only.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
