Critical Severity
CVE-2026-109618
Published: Oct 25, 2026
Working RCE exploit, IDS/WAF detection rules (Suricata, ModSecurity, Sigma, Cloudflare), Docker lab, and full analysis for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Only public exploit covering the serializer mismatch → POP chain that bypasses upload_progress mitigations.
# PHP2Shell — CVE-2026-109618 / CVE-2026-109619 — RCE Exploit PoC + Detection Rules
Working RCE exploit, full technical analysis, IDS/WAF detection rules, and a Docker lab for two critical pre-auth vulnerabilities in PHP's session handling. Covers **all 5 attack chains** including the **serializer mismatch → POP chain** (the only public exploit for CVE-2026-109618 that does NOT require `upload_progress`).
**Keywords:** php2shell, php rce, php session exploit, php upload_progress, php serializer mismatch, php pop chain, php deserialization, suricata rules, modsecurity rules, waf bypass, php heap uaf, php session injection
**CVSS v4.0: 9.2 (Critical)** — Pre-auth, no user interaction, arbitrary code execution.
## Affected Versions
| Branch | Vulnerable | Fixed |
|--------|-----------|-------|
| PHP 8.5 | 8.5.0 – 8.5.11 | 8.5.12 |
| PHP 8.4 | 8.4.0 – 8.4.26 | 8.4.27 |
| PHP 8.3 | 8.3.0 – 8.3.35 | 8.3.36 |
| PHP 8.2 | 8.2.0 – 8.2.34 | 8.2.35 |
| PHP 5.4 – 8.1 | All versions | **EOL — no official fix** |
## TL;DR
Two heap use-after-free bugs in PHP's `ext/session/session.c`:
- **CVE-2026-109619** — The `session.upload_progress` handler caches raw `zval *` pointers (`post_bytes_processed`, `current_file_bytes_processed`) into HashTable buckets. When `php_session_rfc1867_update()` calls `php_session_initialize()`, the old session tree is destroyed but the cached pointers are never refreshed, leaving dangling references into freed heap memory. Requires `session.upload_progress.enabled = On` (the default).
- **CVE-2026-109618** — `PS(serializer)` is not reset between PHP-FPM requests (`php_rinit_session_globals` / `php_rshutdown_session_globals` skip it). A worker that processes a request to a directory using `php_serialize` retains that serializer for the next request to a directory using `php` (default). The resulting decode failure triggers `php_session_cancel_decode()` → `php_session_destroy()`, which fires `__destruct` on partially deserialized objects. Combin