PHP曝CVE-2026-109618/109619高危漏洞含利用链
ikow/php2shell-poc: CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre…
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
GitHub repository created 2026-10-21 · 1086 stars in 0.8 days (about 1086 a day) · Python
php2shell
CVE-2026-109618 & CVE-2026-109619 — PHP Pre-Auth RCE Exploit & Detection Toolkit
Exploits · Detection · Lab · Writeup
Five independent RCE chains exploiting PHP's `session.upload_progress` and the Zend engine's OOM bailout. 14 years of vulnerable code — PHP 5.4.0 (2012) through 8.5.11. Pre-auth. No application vulnerability required for some chains.
Impacts 78% of all websites — including WordPress (43%), Joomla, Drupal, Laravel, Magento, and every default PHP installation.
Author: Qi Deng | Writeup: Substack | Date: 2026-10-21
CVE Details
| CVE | GHSA | CVSS | Description | ||
|---|---|---|---|---|---|
| CVE-2026-109618 | GHSA-w8hw-w9fx-j79w | 9.2 | OOM → `longjmp()` leaves Zend engine state invalid → RCE | ||
| CVE-2026-109619 | GHSA-6wmf-4rv5-p3rp | 9.2 | Stale global state across FPM worker requests → UAF → RCE |
Patch: Commit 3584a98 — 300 files changed across the Zend engine.
Attack Chains
| Chain | Vector | Pre-auth | Conditions | SAPI | ||
|---|---|---|---|---|---|---|
| A | Session injection + LFI | Yes | App has any LFI sink | All | ||
| B | var_destroy UAF → handler overwrite | No | App calls `unserialize()` | All | ||
| C | Handler mismatch → `__destruct` | Yes | Two dirs with different serialize_handler | FPM | ||
| D | OOM corruption → stale `EG()` | Yes | None — any endpoint | mod_php | ||
| E | FPM session OOM → stale `BG()` | Yes | Producer: any `session_start()` endpoint; Consumer: any endpoint | FPM |
Chain D is the most critical: zero-dependency pre-auth RCE against any Apache mod_php installation.
Chain E is nearly as broad on FPM: the producer needs any endpoint that calls `session_start()` (near-universal — WordPress, Laravel, Joomla, Drupal all do), and the consumer can be any PHP endpoint — the `rfc1867` upload_progress handler runs during SAPI startup before application code. Verified: `nosession.php` (no `session_start()` in code) triggers 502 crash when consuming stale `BG(unserialize)` state.
Exploits
Three RCE exploits (Chains A, B, C) are included in `exploit/`:
| File | Chain | What It Does | ||
|---|---|---|---|---|
| `chain_a_session_lfi.py` | A | Injects PHP code via upload filename → LFI includes session file → RCE | ||
| `chain_b_uaf_rce.php` | B | var_destroy UAF → discovers `zif_system` via EG() → overwrites `var_dump` handler via `/proc/self/mem` → RCE | ||
| `chain_c_mismatch_rce.py` | C | Pollutes FPM worker `PS(serializer)` → injects serialized object via filename → `__destruct` fires on decode failure → RCE |
Chains D and E exploits are available to paid subscribers.
Detection Rules
Pre-built IDS / WAF / SIEM rules in `detection/`:
| File | Format | Signatures | ||
|---|---|---|---|---|
| `php2shell.rules` | Suricata / Snort | 13 rules — request, response, and recon | ||
| `php2shell.yaml` | Sigma | 5 rules — web logs, process creation, file events | ||
| `modsecurity.conf` | ModSecurity v2/v3 | 7 rules — drop-in for Apache/Nginx | ||
| `php2shell.lua` | OpenResty Lua | Lightweight reverse proxy module |
Fastest mitigation: block `PHP_SESSION_UPLOAD_PROGRESS` in multipart POST bodies. Near-zero legitimate use, covers the primary attack vector for both CVEs.
Quick Start
Repository Structure
Mitigation
> The only complete fix is patching PHP to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12+. The OOM corruption (Chain D) is in the Zend engine core — no INI setting fixes it.
Downstream Impact
Wiz has demonstrated pre-auth RCE on stock container images:
| Platform | Vulnerable | Notes | ||
|---|---|---|---|---|
| WordPress | Yes | Core doesn't use PHP sessions, but WooCommerce and many plugins do | ||
| Joomla | Yes | Uses native PHP sessions by default | ||
| Drupal | Yes | Uses native PHP sessions by default | ||
| Magento | Yes | Vulnerable even in maintenance mode | ||
| Laravel | Yes | `PendingBroadcast` is a known `__destruct` gadget |
References
- PHP Security Advisory - GHSA-w8hw-w9fx-j79w — CVE-2026-109618 - GHSA-6wmf-4rv5-p3rp — CVE-2026-109619 - Patch commit 3584a98 — 300 files, Zend engine + extensions - Cloudflare WAF coverage - Sansec analysis — PHPSESSID heap leak discovery - Wiz downstream impact - Corelight detection — Zeek + Suricata community rules
Disclaimer
This repository is for authorized security testing and educational purposes only. Exploit code for Chains D and E (zero-dependency RCE) is available to paid subscribers of the writeup.
License
MIT
Keywords: php2shell, CVE-2026-109618, CVE-2026-109619, PHP RCE, PHP exploit, session.upload_progress, pre-auth RCE, PHP vulnerability, PHP session injection, PHP deserialization, PHP OOM, PHP memory corruption, use-after-free, GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp, WordPress RCE, Joomla RCE, Drupal RCE, PHP security, WAF rules, Suricata rules, ModSecurity rules, IDS signatures, PHP 8.2.35, PHP 8.4.27, session upload progress, PHP session fixation, rfc1867, longjmp, zend_bailout, Snort rules, Sigma rules, detection rules, PHP patch, PHP critical vulnerability
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力