PHP2Shell: Turning a Session Upload-Progress UAF into Unauthenticated RCE (CVE-2026-109618 / CVE-2026-109619)
I published PHP2Shell , a proof-of-concept for two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — that enable a heap use-after-free in session.upload_progress and, with the right chain, unauthenticated remote code execution. For security research and authorized testing only. Repo: github.com/syrex1013/php2shell Why this matters PHP’s multipart upload-progress feature (…
PHP2Shell is a proof-of-concept that converts a session upload-progress use-after-free (UAF) vulnerability into remote code execution (RCE) in PHP. The vulnerability (CVE-2026-109618 and CVE-2026-109619) resides in the rfc1867 upload-progress handler and affects multiple PHP versions up to and including 8.5.12. The vulnerability stems from the handler caching raw zval* pointers into the session HashTable which become stale when a multipart upload stalls longer than the session.upload_progress.min_freq.
The PHP2Shell repository provides a full RCE exploit chain, a lab environment for reproducing the UAF primitive, and instructions for safe use. It is recommended to disable session.upload_progress.enabled or upgrade PHP to a fixed release to mitigate the vulnerability.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
