python3 poc.py -u --profile php84-official-prod-v1 -verify --attempts 24 --follow-attempts 36
The lab listens only on `127.0.0.1`. It uses stock WordPress 7.1.3 application
files, a pinned PHP image, five Apache workers, and the PHP settings above.
There is no marker, exploit helper, or debugger endpoint in the lab.
The database and WordPress admin credentials in `lab/` are fixed test values
for this loopback-only fixture. Do not reuse them for a reachable site.
The chain is sensitive to allocation and worker lifetime. A failed attempt
does not undo the verified runs or prove a target is safe. The client reports
the stage where it stopped. Verification creates a small receipt file in the
target's public uploads directory. When finished, remove this disposable lab
and its database volume with `docker compose -f lab/compose.yaml down -v`.
See [EVIDENCE.md](EVIDENCE.md) for the recorded runs and [SHA256SUMS](SHA256SUMS)
The historical Apache campaign completed 10 of 18 trials across the three
tested PHP 8 branches. All eight misses were at the module disclosure stage.
That ratio describes those trials, not a general success rate.
A controlled PHP 8.4.26 FPM fixture also reached command execution with fresh
runtime disclosures. Untouched production-style WordPress behind nginx and
multi-worker FPM has not reached RCE in this research. PHP 7.4.33 has a worker
crash result, but no demonstrated command execution. Catpow is a separate
application-dependent session investigation and is not part of this PoC's RCE
The open problem is broader black-box adaptation: identifying an unknown
binary, finding its internal offsets and compatible heap layout, and handling
frontends and worker routing without a prior profile. None of that is claimed
The PHP project lists 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as fixed supported
releases. Use a fixed vendor package or a supported fixed PHP release.
- [CVE-2026-109618](
- [CVE-2026-109619](
This work builds on earlier PHP2Shell research, especially 9bie's heap
placement and ASLR work. The reproduction, exact build profiling, deployment
comparisons, reliability measurements, and evidence corrections here are my
This research is for systems you own or have explicit permission to test.
The PoC can exhaust memory, crash PHP workers, and run commands as the web
worker on a matching vulnerable target. Follow the applicable law, program
rules, and disclosure process. Upgrade exposed PHP installations.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
