Critical Severity
CVE-2026-109619
Published: Oct 26, 2026
Exploit tooling and vulnerability research for CVE-2026-109618 and CVE-2026-109619 — two critical unauthenticated remote code execution (RCE) vulnerabilities patched in PHP 8.4.27, 8.3.36, 8.2.35, and 8.5.12 (released October 21, 2026).
# php2shell
[](https://github.com/l3tchupkt)
[](https://www.php.net/archive/2026.php#2026-10-21-5)
[](https://python.org)
Exploit tooling for **CVE-2026-109618** and **CVE-2026-109619** — two critical unauthenticated RCE vulnerabilities patched in PHP 8.4.27, 8.3.36, 8.2.35, and 8.5.12 (released October 21, 2026).
Developed by **[l3tchupkt](https://github.com/l3tchupkt)**.
> **Disclaimer:** For authorized penetration testing and security research only.
---
## CVE Overview
| CVE | Title | CVSS v4 | Affected | Patched |
|-----|-------|---------|----------|---------|
| **CVE-2026-109618** | Zend OOM Corruption via `longjmp` | 9.2 | < 8.4.27 / 8.3.36 / 8.2.35 / 8.5.12 | 8.4.27+ |
| **CVE-2026-109619** | Pre-RINIT Session Object UAF | 9.2 | < 8.4.27 / 8.3.36 / 8.2.35 / 8.5.12 | 8.4.27+ |
**Root cause commit:** `31c0ea7d` — "Avoid state corruption via bailout"
**Official advisory:** https://www.php.net/archive/2026.php#2026-10-21-5
---
## Root Cause Analysis
### CVE-2026-109619 — Pre-RINIT Session Object Deserialisation (UAF)
**Source file:** `ext/session/session.c`
PHP's RFC1867 upload-progress callback (`php_session_rfc1867_callback`) fires **before** `php_request_startup()` completes — i.e., pre-RINIT. On unpatched PHP, this callback reads and fully deserialises the existing session file, instantiating PHP objects and calling `__wakeup()`. This runs while `PS()` globals may still reference freed memory from the previous FPM worker request — a Use-After-Free.
**The patch** added `PS(in_rfc1867_update)` flag and `incomplete_classes_only` mode:
```c
// ext/session/session.c (PHP 8.4.27)
static void php_session_unserialize_init(php_unserialize_data_t *var_hash) {
PHP_VAR_UNSERIALIZE_INIT(*var_hash);
if (PS(in_rfc1867_update)) {