---
id: 10214
title: "CVE-2026-109618 / CVE-2026-109619: PHP session.upload_progress Pre-Auth RCE PoC & Research"
cve: CVE-2026-109618
cvss: 9.2
severity: critical
vendor: "PHP"
product: "PHP"
affected_versions: "5.4.0 - 8.5.11"
source_domain: github.com
source_url: "https://github.com/ikow/php2shell-poc"
published_at: "2026-10-21T07:55:16Z"
tags: ["rce", "poc"]
phying_url: "https://phying.com/item/10214"
lang: en
---

# CVE-2026-109618 / CVE-2026-109619: PHP session.upload_progress Pre-Auth RCE PoC & Research

## Summary

Independent security research detailing two critical pre-auth remote code execution (RCE) vulnerabilities in PHP core's session.upload_progress handler (CVSS 9.2), affecting PHP 5.4.0 through 8.5.11. The repository provides verification PoCs and Docker lab environments demonstrating multiple attack chains, including session file injection via unvalidated filenames combined with LFI, heap use-after-free in var_destroy via unserialize(), and cross-request handler mismatch leading to object injection.

## Why it matters

Affecting over a decade of PHP releases with session.upload_progress enabled by default, these flaws allow attackers to achieve pre-auth code execution through multiple independent vectors without relying on application-level file uploads.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-109618
- **CVSS:** 9.2
- **Vendor:** PHP
- **Product:** PHP
- **Affected versions:** 5.4.0 - 8.5.11
- **Published:** 2026-10-21T07:55:16Z
- **Original:** https://github.com/ikow/php2shell-poc
- **Phying News:** https://phying.com/item/10214