Low Severity
CVE-2026-109618
Published: Oct 28, 2026
Analysis and negative control for CVE-2026-109618/109619: which PHP builds still arm, why 8.4.27 does not, and why the chain does not transfer to PHP-FPM. Exploit withheld until 2026-11-25.
# php2shell — analysis and negative control
What is published here is the **measurement half** of a reproduction of CVE-2026-109618 / CVE-2026-109619:
which PHP builds are affected by this chain class, how the fix actually behaves, and why the chain does not
transfer to PHP-FPM. The working exploit (the four request stages, their calibration probes and the
runbook) is withheld in a private lab under an embargo that runs **until at least 25 November 2026** — see
[NOTICE.md](NOTICE.md) for what that means and why.
The research narrative, including the wrong turns, is in [HISTORY.md](HISTORY.md).
## The two failure classes, kept apart
`session.upload_progress` fails in two ways that are easy to conflate, and conflating them produces a
wrong severity assessment:
| class | what it is | fixed by |
|---|---|---|
| **application-level** | the upload-progress handler writes an unsanitised filename into the session file; an application that later `include()`s session state executes attacker-shaped content | the application, not the engine |
| **engine-level** | an allocation failure inside the session encoder leaves a dangling session identifier; a later request reads through it and discloses memory | a PHP patch |
The engine-level condition is what this repository measures.
## What the measurements say
Three results, each obtained by running the same shapes on the official images with a single Apache child
and reading the failing allocation out of the container log. The arming step needs one very specific
refusal — a **4096-byte page** inside the session encoder — so that number is the signature.
| image | arming signature | reading |
|---|---|---|
| `php:8.4.26-apache` | **`4096`** | affected; full chain verified 3/3 |
| `php:8.5.11-apache` | **`4096`** | affected, with the same body, at stock ini |
| `php:8.4.27-apache` | none | fixed |
| `php:8.5.12-apache` | none | fixed |
| `php:8.3.36-apache` | none | fixed |
| `php:8.2.35-apache` | none | fixed |
Where the f