AI BriefingPickphp2shell-poc: PHP 14-Year-Old RCE: 5 Chains and Detection Rules
ikow/php2shell-poc
About the project
A research repository for PHP pre-authentication RCE vulnerabilities targeting CVE-2026-109618 and CVE-2026-109619. It provides five independent attack chains that enable remote code execution by exploiting flaws in session.upload_progress and Zend engine OOM handling, which existed for 14 years from PHP 5.4.0 to 8.5.11.
Notably, Chain D can target any endpoint in an Apache mod_php environment and is exploitable without dependencies, while Chain E is valid in an FPM environment as long as session_start() is called. The repository includes actual exploit code for Chains A, B, and C, POC scripts to verify each chain, and configuration files for a Docker-based experimental environment.
Pre-configured detection rules in Suricata, Sigma, ModSecurity, and OpenResty Lua formats are provided for attack response. The quickest mitigation is to block PHP_SESSION_UPLOAD_PROGRESS in multipart POST bodies, while a complete resolution requires patching to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or later.
78% of sites using default PHP installation environments, such as WordPress, Joomla, Drupal, Magento, and Laravel, are affected. This can be used by security engineers to assess vulnerability impact and deploy detection rules, or by developers to verify patch application.
ikow/php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
Python
This introduction was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report errors, attribution issues, or removal requests via Contact.