Critical Severity
CVE-2026-109619
Published: Oct 26, 2026
Working local PoC for the php2shell PHP RCE pair (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution via session.upload_progress multipart OOM in Apache mod_php. Docker A/B lab (8.4.26 vs 8.4.27), exploit patch for emulated x86-64, and patch-verification methodology.
# php2shell (CVE-2026-109618 / CVE-2026-109619)
Proof-of-concept and working exploit for the **php2shell** PHP remote code execution pair —
**CVE-2026-109618** and **CVE-2026-109619**. Both are unauthenticated RCE in PHP's
`session.upload_progress` multipart handling. This repository reproduces the full chain in a
Docker lab against `php:8.4.26-apache` and A/B-validates it against the patched
`php:8.4.27-apache` build, and ships a passive `X-Powered-By` version-detection template.
- **CVE-2026-109618** — RCE via OOM corruption. `longjmp()` on allocation failure exits a
request-startup context that never finished initialising, leaving request memory invalid;
the shutdown path then processes it. Apache mod_php is the confirmed-exploitable SAPI.
- **CVE-2026-109619** — RCE via stale global state retained across requests in a worker.
Both are fixed in PHP **8.2.35 / 8.3.36 / 8.4.27 / 8.5.12**. Branches 8.1 and older are EOL
with no patch.
Advisories: [GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
· [GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
## Result
Full unauthenticated RCE against `php:8.4.26-apache` in Docker, over plain HTTP:
```
[+] chunk base = 0x4008000000
[+] libphp base = 0x4005a99000
[+] stage 3 attempt 1 succeeded
PROOF:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
Identical attack against `php:8.4.27-apache`: no leak, 0 heap-corruption events, no
execution. See **[RCE-PROOF.md](RCE-PROOF.md)** for the full writeup, the A/B table, and the
three harness mistakes that made an earlier attempt look "blocked".
## Reproduce
Requires Docker, Python 3.9+. Everything runs on `127.0.0.1`.
```bash
./run-rce-poc.sh
```
The script clones the upstream PoC into `upstream/`, builds a vulnerable (8.4.26) and a
patched (8.4.27) target, applies `ptr-range.patch`, runs the same exploit against both, and
prints the comparison.
Manual run:
```bash
git