{
  "id": 15907447,
  "title": "PHP2Shell: Turning a Session Upload-Progress UAF into Unauthenticated RCE (CVE-2026-109618 / CVE-2026-109619)",
  "url": "https://urgent.news/2026/10/21/php2shell-turning-a-session-upload-progress-uaf-into-unauthenticated",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T15:18:18.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/syrex1013/php2shell-turning-a-session-upload-progress-uaf-into-unauthenticated-rce-cve-2026-109618--30ab"
  },
  "original_language": "en",
  "account": "PHP2Shell is a proof-of-concept that converts a session upload-progress use-after-free (UAF) vulnerability into remote code execution (RCE) in PHP. The vulnerability (CVE-2026-109618 and CVE-2026-109619) resides in the rfc1867 upload-progress handler and affects multiple PHP versions up to and including 8.5.12. The vulnerability stems from the handler caching raw zval* pointers into the session HashTable which become stale when a multipart upload stalls longer than the session.upload_progress.min_freq. The PHP2Shell repository provides a full RCE exploit chain, a lab environment for reproducing the UAF primitive, and instructions for safe use. It is recommended to disable session.upload_progress.enabled or upgrade PHP to a fixed release to mitigate the vulnerability.",
  "summary": "I published PHP2Shell , a proof-of-concept for two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — that enable a heap use-after-free in session.upload_progress and, with the right chain, unauthenticated remote code execution. For security research and authorized testing only. Repo: github.com/syrex1013/php2shell Why this matters PHP’s multipart upload-progress feature (…",
  "key_points": [
    "PHP2Shell converts session upload-progress UAF into RCE",
    "Vulnerability affects PHP versions up to 8.5.12",
    "Disable session.uploadprogress.enabled or upgrade PHP"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}