Critical Severity
CVE-2026-109618
Published: Oct 25, 2026
CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.
# php2shell — CVE-2026-109618 / CVE-2026-109619
Two pre-auth `session.upload_progress` bugs in PHP core. This repository has the
mechanics, a working remote chain on stock `php.ini-production`, four more
exploit paths, and the post-patch evidence.
[中文](README.zh-CN.md) · **Download:** [php2shell v2.0](https://github.com/xuehuolll/php2shell-CVE-2026-109618-109619/releases/tag/v2.0)
> MITRE: `PUBLISHED` (2026-10-21) · NVD: not yet ingested · php.net: advisory published.
**Contents:** [Verdict](#verdict-in-30-seconds) · [Defenders](#tldr-for-defenders) · [The two CVEs](#the-two-cves) · [Exploit paths](#exploit-paths) · [CVE flow](#cve-flow) · [After the patch](#after-the-patch-8512) · [Tests](#tests) · [Quick start](#quick-start) · [Status](#status) · [Limits](#limits) · [Files](#files)
## Verdict in 30 seconds
| Question | Answer |
|---|---|
| Can it give a shell? | ✅ yes — remote on unpatched 8.4.x mod_php; the production-ini chain is verified on `php:8.4.26-apache` |
| Is it pre-auth? | ✅ yes — the rfc1867 callback runs before application code |
| Is it universal? | ❌ no — mod_php prefork only, build-specific offsets, bookworm/8.4.20/8.5.11 not calibrated |
| Does the patch close it? | ✅ the two CVEs, yes; three application-level paths still work on 8.5.12 |
## TL;DR for defenders
| Action | Why |
|---|---|
| Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | closes both CVEs (see [analysis/11](analysis/11-official-patch.md)) |
| Cannot patch: `memory_limit=-1` | the only config mitigation against 109618 |
| Cannot patch: `session.upload_progress.enabled=Off` + restart workers | breaks the session producer for 109619 |
| 8.5 only: `fatal_error_backtraces=0` + restart workers | removes the producer used by the confirmed RCE case |
| Drop `