Critical Severity
CVE-2026-109619
Published: Oct 25, 2026
PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance for authorized security testing.
# PHP2Shell
**Pre-auth RCE research toolkit for CVE-2026-109618 / CVE-2026-109619**
`exploit by devploit`
*Verified run against the local PHP 8.5.11 laboratory: `uid=33(www-data)`.*
> **Authorized testing only.** Use this material exclusively against systems you
> own or have explicit, written permission to test. It is not a scanning tool,
> it ships no target list, and it must not be used against third-party
> infrastructure. The chain is disruptive: it sends large request bodies,
> triggers pre-RINIT out-of-memory conditions and kills Apache children.
PHP2Shell is a research workspace for the `session.upload_progress` OOM /
stale-pointer chain in PHP's Apache module. It packages a version-aware
dispatcher, a per-build profile engine, reproducible laboratories, a calibration
factory and runtime instrumentation around the public research exploit by
[9bie](https://github.com/9bie/php2shell-bypass-aslr-exp).
The goal is reproducible research and defensive validation, not mass
exploitation. The dispatcher refuses to guess: it stops when the build has no
verified profile, when the target is a fixed release, or when the target OS does
not match the profile.
---
## Status
| Build | Image | Profile | Heap leak | libphp leak | RCE | Notes |
| --- | --- | --- | --- | --- | --- | --- |
| PHP 8.5.11 aarch64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
| PHP 8.5.11 amd64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-amd64` | yes | yes | **yes** | separate offsets, same `htdata` |
| PHP 8.5.10 aarch64 | `php:8.5.10-apache` | `php-8.5.10-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
| PHP 8.4.26 amd64 | `php:8.4.26-apache` | `php-8.4.26-bookworm-amd64` | yes | yes | **yes** | reference build |
| PHP 8.4.25 aarch64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stag