PHP2SHELL

**CVE-2026-109618** is a critical memory corruption and logic vulnerability in the PHP engine related to file upload progress tracking via sessions (`session.upload_progress`).

The flaw lies in how the external pointer `post_bytes_processed` is cached during the first phase of the request (`FILE_START`) and fails to properly refresh in subsequent upload events. By combining a race condition, the destructive release of Hash trees (`HashTable.pDestructor = zval_ptr_dtor`), and a controlled heap spray using padded structures (`t[]` packed natural tables), it is possible to overwrite internal engine function pointers (such as `zend_call_function`) to redirect execution flow to `system()` with arbitrary commands.

The tool requires the **`rich`** library for rendering the console interface, banners, and interactive panels.

git clone [

Run the script with the appropriate parameters for the targeted system:

python3 php2shell.py -u "[ -c "uname -a; id"

-u, --url Full URL of the vulnerable PHP endpoint Required

-c, --command Command to execute on the operating system uname -a; id; echo JACKALPOC

--sid Custom session identifier (PHPSESSID) a1b2c3d4e5f6a7b8c9d0e1f2a3

--dtor Leaked memory address of zval_ptr_dtor (hex/int) 0

--call Explicit memory address for zend_call_function Calculated via offset

--dry Simulation mode: generates and saves the binary payload to disk False

Heap Spraying: Utilizes a block of 149 elements (packed natural table with 320-byte bins) to ensure the reuse of the freed memory block.

SAPI Support: Designed for environments evaluated under CGI/FastCGI architectures and compatible front-end servers (such as LiteSpeed LSAPI / Apache / Nginx).

Dry Run: Allows dumping the exact byte stream of the generated multipart payload for forensic analysis or debugging using the --dry flag.

Affected Versions: PHP 5.4 up to PHP 8.x (Patches released by PHP maintainers for 8.2, 8.3, 8.4, and 8.5).

Heap Spraying: Utilizes a block of 149 elements (packed natural table with 320-byte bins) to ensure the reuse of the freed memory block.

SAPI Support: Designed for environments evaluated under CGI/FastCGI architectures and compatible front-end servers (such as LiteSpeed LSAPI / Apache / Nginx).

Dry Run: Allows dumping the exact byte stream of the generated multipart payload for forensic analysis or debugging using the --dry flag.

This software has been created exclusively for educational purposes, security research, and authorized auditing use (Pentesting).The author (Ghxstsec) assumes no responsibility for misuse or damage caused by the improper use of this script on unauthorized systems.