php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
php2shell-CVE-2026-109618-CVE-2026-109619-PoC launched on 21 October 2026. It ranked #54 on Daily Launch on 23 October 2026 with a Launch Score of 39, from +221 stars on 23 Oct on GitHub. It moved down 38 places from the day before.
What is Php2shell CVE 2026 109618 CVE 2026 109619 PoC?
php2shell refers to two critical vulnerabilities (CVE-2026-109618 & CVE-2026-109619) affecting core PHP functionality. The primary demonstrated vector is a heap use-after-free (UAF) in the PHP core session upload progress mechanism leading to arbitrary code execution (zendcallfunction / system()). During request processing: 1. Trigger: A standard multipart POST request activates progress tracking with default configuration values (session.uploadprogress.enabled = 1). 2. Free: A progress update cycle re-reads session data. The function zendhashupdate() destroys the previous data tree using the destructor zvalptrdtor, freeing the memory block. 3.
From its README on GitHub
Php2shell CVE 2026 109618 CVE 2026 109619 PoC (php2shell-CVE-2026-109618-CVE-2026-109619-PoC) is a repo by eness on GitHub. It is written in Shell.
How to get Php2shell CVE 2026 109618 CVE 2026 109619 PoC
Get it from its repository on GitHub.
