Critical Severity
CVE-2026-109618
Published: Nov 2, 2026
Patch-derived PoC and RCE for the PHP session upload-progress pre-RINIT decode (CVE-2026-109618/109619)
# php2shell-exp
Reverse-engineered PoC and RCE from PHP official patch [`3584a98bda`](https://github.com/php/php-src/commit/3584a98bda), with 8.2.34 / 8.2.35 dual-container differential environment.
Patch-derived PoC and RCE for the pre-RINIT session decode in PHP's upload-progress handler.
## What is this
- `exp/poc_pre_rinit.py` — PoC demonstrating upload-progress decodes session before RINIT and executes object destructors, without command execution
- `exp/exp_rce.py` — Arbitrary command execution on the same code path, output read back over HTTP
- `exp/poc_oom.py` — OOM trigger for CVE-2026-109618 (trigger only, not RCE)
- `lab/` — `php:8.2.34-fpm` and `php:8.2.35-fpm`, each with nginx
This chain exploits stably on 8.2.34, blocked by `incomplete_classes_only` on 8.2.35. It is not a zero-dependency exploit: requires target to already have a class with dangerous magic methods pre-RINIT; lab simulates this with `opcache.preload`.
## Verified
Same code, same configuration, different images only:
| Branch | Exploitable | Patched |
|---|---|---|
| 8.1 | 8.1.34 (EOL, no official patch) | — |
| 8.2 | 8.2.34 | 8.2.35 |
| 8.3 | 8.3.35 | 8.3.36 |
| 8.4 | 8.4.26 | 8.4.27 |
| 8.5 | 8.5.11 | 8.5.12 |
Output of `./verify.sh` on 8.2 branch:
```
PoC 8.2.34 (expect 0) 0
PoC 8.2.35 (expect 1) 1
RCE 8.2.34 (expect 0) 0
RCE 8.2.35 (expect 1) 1
[+] differential holds
```
Full output and call stack diagnostics in [`docs/RESULTS.md`](docs/RESULTS.md).
## Technical Details
The patch marks upload-progress decoding as "pre-RINIT, user code not allowed" and enables `incomplete_classes_only` for this phase. Before patching, this decoding would instantiate objects from session records as real class instances, with `__wakeup` / `__unserialize` / `Serializable::unserialize` / `__destruct` all running before target script compilation.
Exploitation in two steps, both via HTTP:
1. `POST /app/upload.php`. The `.user.ini` in that directory sets `session.serialize_handler=php_serialize`; upload-progress writes multipart filename as-is to session file, `x|O:6:"PrePwn":...` pipe included.
2. `POST /api/pre.php`. That directory uses default `php` handler, script has no `session_start()`. During request startup phase `php_session_rfc1867_update()` still decodes: `php` decoder splits at first `|`, passes latter half to `unserialize()`.
3. On 8.2.34 objects instantiate as real classes, `__destruct()` executes `shell_exec($cmd)`, output written to random file under webroot.
4. On 8.2.35 same data downgraded to `__PHP_Incomplete_Class`, no destructor, no file.
Payload explicitly constructed by `exp/lib2shell.py::php_object()`, length prefix calculated per byte:
```
x|O:6:"PrePwn":2:{s:3:"cmd";s:12:"id; hostname";s:3:"out";s:33:"/var/www/html/.pwn_xxxxxxxx.txt";}
```
Patch hunks and line-by-line code correspondence in [`docs/DERIVATION.md`](docs/DERIVATION.md).
## Quick Start
Requires Docker Compose and Python 3.8+ (standard library only).