php2shell-poc open-sources two CVSS 9.2 pre-auth PHP RCE exploits affecting 14 years of releases
evilsocket · x · 2026-10-23
Security researchers have open-sourced php2shell-poc, a POC and analysis repo for CVE-2026-109618 and CVE-2026-109619, two CVSS 9.2 pre-authentication RCE bugs in PHP's session.uploadprogress handler. One chain triggers an OOM whose longjmp() leaves the Zend engine in an invalid state; the other exploits stale global state across FPM worker requests causing use-after-free. Vulnerable code dates back to PHP 5.4.0 (2012), and the upstream patch touches 300 files across the Zend engine. The repo ships three end-to-end verified attack chains against a bundled lab, each ending in an interactive shell.
Related event: OpenAI Models Help Uncover Critical PHP Flaws Affecting Most of the Web(113 posts)→
More from Safety
- Leaked PHP2Shell RCEs (CVSS 9.2) Draw Scans 20 Minutes After Patch, No Confirmed Exploits Yet — cyb3rops · 2026-10-23
- Chinese AI labs embrace 'recursive self-improvement' — but the story is bottom-up, not state-coordinated — Afinetheorem · 2026-10-23
- AI researcher: even dumb models are now powerful hacking tools, sparking an AI cyber arms race — Yuchenj_UW · 2026-10-23
- David Sacks: user-authorized AI agents sharing bank credentials aren't cyberattacks — kevinnbass · 2026-10-23
- Brotli memory corruption bug CVE-2026-111497 reproduced with a simple Node.js app — evilsocket · 2026-10-23
- DeepSeek and MiniMax clear China's new AI export rules for overseas releases — Stannis_Loyalist · 2026-10-23