Why it matters: Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
The research team releases an open source tool php2shell-scanner which contains a high fidelity scanning mechanism to check for CVE-2026-109618 and CVE-2026-109619 across hosts.
# PHP RFC 1867 lab — two independent RCE chains on PHP 8.5.11 Private, embargoed reproduction package for the PHP 8.5.11 Apache lab RCE work, 18–21 October 2026. **Status: Proven — lab-assisted...
Why it matters: Provides definitive lab evidence and control ladders clarifying the actual exploitability of php2shell, refuting circulating unworkable cached-zval UAF theories while proving concrete RCE vectors on stock PHP 8.5.11.
# php2shell — CVE-2026-109618 / CVE-2026-109619 > **Critical Advisory (CVSS v4.0: 9.2 - Critical):** On October 20, details of two pre-auth Remote Code Execution (RCE) flaws in the PHP core leaked...
Why it matters: Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
Independent security research detailing two critical pre-auth remote code execution (RCE) vulnerabilities in PHP core's session.upload_progress handler (CVSS 9.2), affecting PHP 5.4.0 through 8.5.11. The repository provides verification PoCs and Docker lab environments demonstrating multiple attack chains, including session file injection via unvalidated filenames combined with LFI, heap use-after-free in var_destroy via unserialize(), and cross-request handler mismatch leading to object injection.
Why it matters: Affecting over a decade of PHP releases with session.upload_progress enabled by default, these flaws allow attackers to achieve pre-auth code execution through multiple independent vectors without relying on application-level file uploads.