Critical Severity
CVE-2026-109619
Published: Oct 26, 2026
Complete auto exploit for NGINX PHP-FPM CVE-2026-109618 / CVE-2026-109619
# php2shell-nginx-fpm-full-rce
[](https://github.com/VABISMO/php2shell-nginx-fpm-full-rce/actions/workflows/ci.yml)
[](https://github.com/VABISMO/php2shell-nginx-fpm-full-rce/actions/workflows/live-fpm.yml)
[](LICENSE)
[](https://www.php.net/)
[](https://www.python.org/)
A self-contained **nginx + PHP-FPM RCE** laboratory and exploit client for the
cross-request `BG(unserialize)` stale-state chain. It ships verified profiles
for **PHP 8.2.34, 8.3.35, 8.4.0, 8.4.25 and 8.4.26** (fixed upstream in
8.2.35 / 8.3.36 / 8.4.27 / 8.5.12) plus the pre-auth **session-file plant**
that covers PHP 5.4-7.x. This is the FPM-only extraction of
[`devploit/php2shell`](https://github.com/devploit/php2shell): no Apache code,
no Docker, no root.
> **Authorized security testing only.** Use this only on systems you own or
> have explicit written permission to test. The chain sends large bodies,
> triggers OOM conditions, and kills PHP-FPM workers. Run it against disposable
> local laboratories. See [LICENSE](LICENSE) and [SECURITY.md](SECURITY.md)
> (support matrix, reporting, disclosure timeline).
**Keywords:** PHP-FPM RCE, nginx PHP-FPM exploit, CVE-2026-109619, PHP 8.2,
PHP 8.3, PHP 8.4, PHP 8.4.27, session deserialization, `BG(unserialize)`, stale pointer,
use-after-free, ASLR bypass, HTTP-only leak, no-oracle, `zif_system`, FastCGI,
nginx security research, PHP session upload progress, exploitation laboratory.
## Table of contents
- [What this is](#what-this-is)
- [Affected builds](#affected-builds)
- [How the chain works](#how-the-chain-works)
- [Repository layout](