eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
Older snapshot: check the original source for current information.
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
php2shell refers to two critical vulnerabilities (CVE-2026-109618 & CVE-2026-109619) affecting core PHP functionality. The primary demonstrated vector is a heap use-after-free (UAF) in the PHP core session upload progress mechanism leading to arbitrary code execution (zendcallfunction / system()). PHP's upload progress handler (phpsessionrfc1867callback in ext/session/session.c) stores two raw zval bucket pointers (postbytesprocessed and currentfilebytesprocessed) directly in live HashTable structures. During request processing: The following table summarizes the PHP versions affected by CVE-2026-109618 and CVE-2026-109619, along with their support and patch statuses: Exploitation of php2shell typically manifests as anomalous child processes spawned directly by PHP worker processes (php-fpm, php-cgi, php-cgi.exe, httpd, apache2). Monitor and alert on PHP worker processes executing: For Linux-based web environments without an endpoint detection agent, tools like Florian Roth's free process-watcher can be run in observe mode to flag unusual child process spawning in real time. A fully automated one-click remote exploit targeting CVE-2026-109618 is available in…
Read the full README ↗ · Preview checked 2026-10-27T17:29:28.775Z
Inside the original README — Document outline
- php2shell — CVE-2026-109618 / CVE-2026-109619
- Table of Contents
- Overview
- Root Cause
- Verification & Targets
- Affected PHP Versions
- Threat Landscape & Detection Guidance
- Behavioral Indicators & Suspicious Child Processes
- Monitoring Recommendation
- Action Items for Organizations
- Proof of Concept (PoC)
- Exploit Architecture & Stages
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Links from the README
References supplied by the publisher, not independently verified endorsements. Check the destination before downloading files or entering credentials.
Documentation belongs to its respective authors. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
Repository facts
- Owner
- eness
- Primary language
- Shell
- Stars
- 1,035
- Forks
- 259
- Open issues + pull requests
- 7
- License
- Not reported — inspect the license file
- Archived
- No
- Default branch
- main
- Created
- 2026-10-21T08:31:43.000Z
- Last push
- 2026-10-22T07:19:20.000Z
Topics and intended use
No topics were included in the latest source metadata.
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-10-28T12:14:58.607Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.