CVE-2026-109618 / CVE-2026-109619: PHP session.upload_progress Pre-Auth RCE PoC & Research
Summary
Independent security research detailing two critical pre-auth remote code execution (RCE) vulnerabilities in PHP core's session.upload_progress handler (CVSS 9.2), affecting PHP 5.4.0 through 8.5.11. The repository provides verification PoCs and Docker lab environments demonstrating multiple attack chains, including session file injection via unvalidated filenames combined with LFI, heap use-after-free in var_destroy via unserialize(), and cross-request handler mismatch leading to object injection.
Why it matters
Affecting over a decade of PHP releases with session.upload_progress enabled by default, these flaws allow attackers to achieve pre-auth code execution through multiple independent vectors without relying on application-level file uploads.
- CVE
- CVE-2026-109618
- Vendor
- PHP
- Product
- PHP
- Affected versions
- 5.4.0 - 8.5.11
- CVSS
- 9.2
- Published
- Collected
--- id: 10214 title: "CVE-2026-109618 / CVE-2026-109619: PHP session.upload_progress Pre-Auth RCE PoC & Research" cve: CVE-2026-109618 cvss: 9.2 severity: critical vendor: "PHP" product: "PHP" affected_versions: "5.4.0 - 8.5.11" source_domain: github.com source_url: "https://github.com/ikow/php2shell-poc" published_at: "2026-10-21T07:55:16Z" tags: ["rce", "poc"] phying_url: "https://phying.com/item/10214" lang: en --- # CVE-2026-109618 / CVE-2026-109619: PHP session.upload_progress Pre-Auth RCE PoC & Research ## Summary Independent security research detailing two critical pre-auth remote code execution (RCE) vulnerabilities in PHP core's session.upload_progress handler (CVSS 9.2), affecting PHP 5.4.0 through 8.5.11. The repository provides verification PoCs and Docker lab environments demonstrating multiple attack chains, including session file injection via unvalidated filenames combined with LFI, heap use-after-free in var_destroy via unserialize(), and cross-request handler mismatch leading to object injection. ## Why it matters Affecting over a decade of PHP releases with session.upload_progress enabled by default, these flaws allow attackers to achieve pre-auth code execution through multiple independent vectors without relying on application-level file uploads. ## Intelligence Metadata - **Sources:** github.com - **CVE:** CVE-2026-109618 - **CVSS:** 9.2 - **Vendor:** PHP - **Product:** PHP - **Affected versions:** 5.4.0 - 8.5.11 - **Published:** 2026-10-21T07:55:16Z - **Original:** https://github.com/ikow/php2shell-poc - **Phying News:** https://phying.com/item/10214