Critical Severity
CVE-2026-109619
Published: Nov 5, 2026
CVE-2026-109618 / CVE-2026-109619, PHP session handler stale-pointer RCE PoC, diagnostic tool, and detection rules (Sigma/Suricata). CVSS 9.2 Critical.
# php2shell - CVE-2026-109618 / CVE-2026-109619 PoC
**Remote Code Execution via PHP Session Handler Stale Pointer**
Two critical vulnerabilities in PHP's session upload progress handler allow unauthenticated remote code execution. The CVEs affect all PHP SAPI modes (mod_php, PHP-FPM, etc.); this repo's exploit tools target stock Apache + mod_php (prefork) deployments specifically. No application-level vulnerability (LFI, file upload, deserialization) is required -- just a reachable `index.php`.
When cloning the repo, first thing you do is run `./selftest.sh` to ensure nothing is missing or broken.
Then if applicable, you run `./selftest.sh --docker` to boot the vulnerable php:8.4.26-apache container, run the full exploit chain, and check for the proof file.
Red teamers are expected to read the instructions and know what to do.
The point of this repo is to help detect what servers are vulnerable and to provide evidence of working code.
I take no credit for creation of the PoCs. Just thought they would be good to have in one place, along with detection and remediation guidance.
| | |
|---|---|
| **CVE-2026-109618** | `post_bytes_processed` stale pointer -- hash-table insertion increments counters before allocation completes; OOM during `php_url_encode()` in `END` cleanup leaves an uninitialized bucket that `php_session_flush()` treats as a valid `zend_string` |
| **CVE-2026-109619** | `current_file_bytes_processed` stale pointer -- worker-wide `PS()` fields point to freed per-request memory; a subsequent request follows the stale pointer before re-initialization |
| **CVSS v4** | **9.2 Critical** (both) |
| **Disclosed** | 2026-10-21 |
| **Affected** | PHP 5.4 through 8.5.11 (patches available for 8.2-8.5 only; all EOL versions are vulnerable) |
| **Fixed in** | PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
| **Vector** | Network / No authentication / No user interaction |
## Am I affected?
If you run **any** of these PHP versions, you are vulnerable regardless of SAPI