Low Severity
CVE-2026-109618
Published: Oct 25, 2026
PHP2Shell proof of concept for CVE-2026-109618 and CVE-2026-109619, with Docker labs and build-specific profiles for security research.
# php2shell
PHP proof of concept for **CVE-2026-109618** / **CVE-2026-109619**.
Pre-auth, cookie-less, pure-HTTP remote code execution via `session.upload_progress` use-after-free. Heap-based ASLR bypass + function pointer overwrite = shell.
**Author: [agrresore](https://github.com/agrresore)**
**Repository: [agrresore/php2shell](https://github.com/agrresore/php2shell)**
## Disclaimer
**Authorized security testing, research, and education ONLY.** Unauthorized access is illegal. Authors not responsible for misuse.
## Affected Versions
| Branch | Vulnerable | Patched |
|--------|-----------|---------|
| PHP 8.5 | < 8.5.12 | 8.5.12+ |
| PHP 8.4 | < 8.4.27 | 8.4.27+ |
| PHP 8.3 | < 8.3.36 | 8.3.36+ |
| PHP 8.2 | < 8.2.35 | 8.2.35+ |
| PHP 8.1/8.0/7.x | All | EOL |
## Features
- Pre-auth RCE — no credentials, no cookies, pure HTTP
- ASLR bypass via ~800KB heap OOB read
- In-band output via two-stage webshell (HTTP GET, instant response)
- File-based output fallback (Docker labs, read-only webroot)
- Interactive shell + reverse shell modes
- Auto-detect arch (x86_64/aarch64), OS, SAPI, MPM
- Profile system with auto-calibration
- Worker pinning for multi-worker Apache pools
## Requirements
- Python 3.10 or newer; Python code uses the standard library only.
- Docker with the Compose plugin for the bundled labs.
- Offsets matching the exact PHP binary and architecture.
## Limitations
This PoC includes build-specific profiles and labs based on Apache mod_php.
A vulnerable PHP version alone does not establish that this PoC will work.
Fingerprinting is heuristic, and distribution packages may contain backported fixes.
The exploit can crash PHP workers and may write temporary files or a webshell.
The included profiles and earlier demonstration results have not been independently
revalidated as part of this repository cleanup.
The lab passwords and phpMyAdmin secret are intentionally public test values.
The Compose files bind HTTP ports to localhost. Use the labs