High Severity
CVE-2026-109618
Published: Oct 25, 2026
Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.
# php2shellbt
<p align="center">
<img src="https://img.shields.io/badge/python-3.6%2B-blue?logo=python" alt="Python 3.6+">
<img src="https://img.shields.io/badge/license-MIT-green" alt="MIT License">
<img src="https://img.shields.io/badge/CVE-2026--109618-critical?color=red" alt="CVE-2026-109618">
<img src="https://img.shields.io/badge/CVE-2026--109619-high?color=orange" alt="CVE-2026-109619">
<img src="https://img.shields.io/badge/no%20dependencies-stdlib%20only-brightgreen" alt="No external dependencies">
</p>
> **php2shellbt** is a standalone Python scanner that detects the php2shell vulnerability chain in PHP web applications — with **zero external dependencies** (pure stdlib).
---
## What is php2shell?
**php2shell** is a critical vulnerability chain that combines PHP session management weaknesses to achieve unauthenticated Remote Code Execution (RCE) without writing any file to disk:
```
upload_progress use-after-free / OOM
│
▼
Session file injection (PHP code embedded in filename field)
│
▼
Local File Inclusion (LFI) of the session file
│
▼
RCE ← PHP code in session file executed by the server
```
Two new CVEs were assigned to the root causes of this chain:
| CVE | Title | Affected PHP | Fixed in |
|-----|-------|-------------|----------|
| **CVE-2026-109618** | Session upload_progress use-after-free / OOM | 5.4.0 – 8.5.11 | 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 |
| **CVE-2026-109619** | `var_destroy` use-after-free (UAF) via `unserialize()` + destructor gadget | 5.4.0 – 8.5.11 | 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 |
---
## Vulnerability Details
### CVE-2026-109618 — Session upload_progress use-after-free / OOM
When `session.upload_progress.enabled = On` (default in PHP ≥ 5.4), an attacker can supply a crafted `PHPSESSID` cookie in a multipart POST request containing the magic key `PHP_SESSION_UPLOAD_PROGRESS`. PHP creates (or reuses) a session file at the attacker-controlled pa