Critical Severity
CVE-2026-10961
Published: Oct 25, 2026
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
# php2shell lab — PHP CVE-2026-109618 / CVE-2026-109619
Lab reproduction and vulnerability-research package for the PHP 8.5.11
php2shell class (CVE-2026-109618, CVE-2026-109619), October 2026.
**Status: Proven — self-contained RCE** (four plain HTTP requests, no
debugger, no local access), plus amplification, patch-gap, and FPM
stale-state findings below.
**Contents:** [Results](#results-at-a-glance) · [Chains](#chains) ·
[Amplification](#52x-memory-amplification) · [Patch gaps](#patch-gaps-on-8.5.12) ·
[FPM stale state](#fpm-stale-bgunserialize) · [WAF bypass](#waf-signature-bypass) ·
[Environment](#exact-environment) · [Quick start](#quick-start) ·
[Proof discipline](#proof-discipline) · [Screening](#defender-screening) ·
[Layout](#repository-layout) · [Public context](#public-context) ·
[Statement](#disclosure-statement)
---
## Results at a glance
| # | Finding | Classification |
|---|---|---|
| 1 | End-to-end self-contained RCE on PHP 8.5.11 — four plain HTTP requests, in-band address sourcing via `PS(id)`→cookie disclosure, both bases from one 512-byte PHPSESSID leak; 12/12 fires, uid=33, 8 ASLR generations | **Proven — self-contained RCE** |
| 2 | 52x memory amplification via duplicate 6-byte multipart headers — defeats `post_max_size` (2.57 MB body OOMs a 128M limit) on PHP 7.4–8.5.11 | **Proven — lab, all four versions** |
| 3 | Three exploit paths survive the 8.5.12 security patch (var_destroy re-entry UAF at n=1015, serialize-handler mismatch, upload-progress injection) | **Proven — ASAN on GPG-verified 8.5.12** |
| 4 | FPM stale `BG(unserialize)`: worker survives a session-decode OOM, stale state is consumed by the next request's rfc1867 window, heap-shaped consumption SIGSEGVs the worker | **Proven — mechanism + DoS; RCE unproven** |
| 5 | `Content-Type` separator bypass (`multipart/form-data, boundary=X`) — every published Content-Type-anchored WAF signature is bypassable | **Proven — SAPI.c parser behavior** |
| 6 | Both CVE chains dead on patched