Critical Severity
CVE-2026-109618
Published: Nov 9, 2026
PoC for PHP session.upload_progress RCE (CVE-2026-109618) — race + heap spray to system()
<p align="center">
<pre>
██████╗ ██╗ ██╗██████╗ ██████╗ ███████╗██╗ ██╗███████╗██╗ ██╗
██╔══██╗ ██║ ██║██╔══██╗╚════██╗██╔════╝██║ ██║██╔════╝██║ ██║
██████╔╝ ███████║██████╔╝ █████╔╝███████╗███████║█████╗ ██║ ██║
██╔═══╝ ██╔══██║██╔═══╝ ██╔═══╝ ╚════██║██╔══██║██╔══╝ ██║ ██║
██║ ██║ ██║██║ ███████╗███████║██║ ██║███████╗███████╗███████╗
╚═╝ ╚═╝ ╚═╝╚═╝ ╚══════╝╚══════╝╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝
</pre>
</p>
<p align="center">
<b>PHP Session Upload Progress Remote Code Execution Exploit (CVE-2026-109618)</b>
</p>
<p align="center">
<img src="https://img.shields.io/badge/Python-3.8%2B-blue.svg" alt="Python Version">
<img src="https://img.shields.io/badge/Exploit-RCE-red.svg" alt="Type">
<img src="https://img.shields.io/badge/License-MIT-green.svg" alt="License">
</p>
---
## 📝 About the Vulnerability (CVE-2026-109618)
**CVE-2026-109618** is a critical memory corruption and logic vulnerability in the PHP engine related to file upload progress tracking via sessions (`session.upload_progress`).
The flaw lies in how the external pointer `post_bytes_processed` is cached during the first phase of the request (`FILE_START`) and fails to properly refresh in subsequent upload events. By combining a race condition, the destructive release of Hash trees (`HashTable.pDestructor = zval_ptr_dtor`), and a controlled heap spray using padded structures (`t[]` packed natural tables), it is possible to overwrite internal engine function pointers (such as `zend_call_function`) to redirect execution flow to `system()` with arbitrary commands.
---
## ⚙️ Requirements & Installation
The tool requires the **`rich`** library for rendering the console interface, banners, and interactive panels.
1. Clone the repository:
```
git clone [https://github.com/Ghxstsec/php2shell-poc.git](https://github.com/Ghxstsec/php2shell-poc.git)
cd php2shell-poc
```
Install the required dependencies
```
pip install -r requirements.txt
```
(Or