php2shell: Critical PHP session.upload_progress pre-auth RCE bugs (CVSS 9.2) get public POCs
jedisct1 · x · 2026-10-21
Security researcher Qi Deng (@ikow) released php2shell, a research repo with POCs and lab setup for two critical pre-auth RCE vulnerabilities in PHP's session.uploadprogress handler (CVE-2026-109618/109619, CVSS v4.0 9.2), affecting PHP 5.4.0 through 8.5.x.
Three verified attack chains:
- Session file injection + LFI: a logic bug requiring uploadprogress=On (default) plus an app-level LFI;
- vardestroy UAF → handler overwrite: memory corruption via unserialize() and /proc/self/mem, verified with ASAN;
- Handler mismatch → destruct: deserialization via cross-directory handler mismatch and a POP gadget.
Key findings also include session fixation via POST body bypassing session.useonly restrictions. Full writeup on the author's Substack.
Related event: POC Released for Critical Pre-Auth RCE in PHP session.upload_progress(2 posts)→
More from Safety
- Researcher calls for independent tests of claims Chinese models write insecure code — dbreunig · 2026-10-21
- China Fines Firms for Poisoning AI Chatbot Answers With Fabricated Content — Sanbi_Ai · 2026-10-21
- Does opencode phone home even with local models? Users flag data concerns — Unusual_Principle536 · 2026-10-21
- Researcher's sardonic recipe: persistent agents, cyberoffense RL, monitors off — 'spooky emergent behaviors' — sebkrier · 2026-10-21
- Hackers steal data of thousands of children via password unchanged for 12 years — Polymarket · 2026-10-21
- Wiz uses Gemini to uncover PHP2Shell, CVSS 10 flaws affecting 70% of the web — ralucaadapopa · 2026-10-21