Critical Severity
CVE-2026-109618
Published: Nov 8, 2026
Pre-auth RCE lab for CVE-2026-109618/CVE-2026-109619 - PHP session.upload_progress heap chain
# PHP2Shell — CVE-2026-109618 / CVE-2026-109619
Pre-auth RCE research lab for PHP's `session.upload_progress` heap chain.
**GitHub:** https://github.com/anmolksachan/php2shell
**Blog:** [PHP2Shell: CVE-2026-109618 Pre-Auth RCE, I Tested It Locally and Here’s How It Works](https://anmolksachan.medium.com/php2shell-cve-2026-109618-pre-auth-rce-i-tested-it-locally-and-heres-how-it-works-0a50d01fa552)
> Authorized testing only. All testing was done against local Docker containers on 127.0.0.1.
---
## Folder Structure
```
php2shell/
├── README.md ← you are here
├── blog.md ← full technical writeup + Medium/GitHub publishing guide
├── php2shell-lab.zip ← everything bundled as a zip (for GitHub release)
├── scripts/ ← run these in order
│ ├── setup.sh ← Step 1: clone toolkit, bootstrap exploit, start Docker labs
│ ├── run_exploit.sh ← Step 2: run the exploit against PHP 8.5.11
│ ├── run_interactive.sh ← Step 3 (optional): interactive REPL
│ ├── test_all_labs.sh ← test all 7 containers at once
│ └── cleanup.sh ← stop and remove all Docker containers
└── toolkit/ ← devploit/php2shell (auto-cloned by setup.sh)
├── tools/ ← dispatcher, labs manager, calibration tools
├── profiles/ ← per-build offset profiles (JSON)
├── lab/ ← Docker lab configs + proof output
└── vendor/ ← 9bie upstream exploit (fetched by bootstrap)
```
---
## Quick Start (do these in order)
```bash
# 1. Start here
cd scripts/
chmod +x *.sh
# 2. Setup: clones toolkit, bootstraps upstream exploit, starts 7 Docker labs
./setup.sh
# 3. Run the exploit against PHP 8.5.11 (verified RCE)
./run_exploit.sh
# 4. Run a custom command
./run_exploit.sh http://127.0.0.1:8106/index.php p2s-lab-8511 "id; uname -a"
# 5. Interactive REPL (one exploit chain per command you type)
./run_interactive.sh
# 6. Test all 7 labs at once
./test_all_labs.sh
# 7. Cle