1.8K ·GitHub
What is this?
This is a security research repository documenting five pre-auth remote code execution chains in PHP's session.upload_progress and Zend engine internals (CVE-2026-109618 and CVE-2026-109619), with proof-of-concept exploits and ready-made detection rules.
This is a security research repository documenting five pre-auth remote code execution chains in PHP's session.upload_progress and Zend engine internals (CVE-2026-109618 and CVE-2026-109619), with proof-of-concept exploits and ready-made detection rules.Is this a ready-to-use exploit kit or just a research write-up?It ships working Python/PHP proof-of-concept exploits for three of the five chains (A, B, C) plus Suricata, Sigma and ModSecurity detection rules; the two most dangerous zero-dependency chains (D and E) have their exploit code withheld and sold to paid subscribers of the writeup.
It ships working Python/PHP proof-of-concept exploits for three of the five chains (A, B, C) plus Suricata, Sigma and ModSecurity detection rules; the two most dangerous zero-dependency chains (D and E) have their exploit code withheld and sold to paid subscribers of the writeup.How do I run the exploits or deploy the detection rules?The three included PoCs (chain_a_session_lfi.py, chain_b_uaf_rce.php, chain_c_mismatch_rce.py) live in exploit/ and run directly against a target PHP app, while the Suricata, Sigma and ModSecurity files in detection/ can be dropped straight into an existing IDS/WAF/SIEM stack.
The three included PoCs (chain_a_session_lfi.py, chain_b_uaf_rce.php, chain_c_mismatch_rce.py) live in exploit/ and run directly against a target PHP app, while the Suricata, Sigma and ModSecurity files in detection/ can be dropped straight into an existing IDS/WAF/SIEM stack.What conditions does a target need for each chain to work?Chain A needs an app with any LFI sink, Chain B needs the app to call unserialize(), Chain C needs two directories with different session.serialize_handler settings under PHP-FPM, and Chain D needs nothing beyond a stock Apache mod_php install; all chains affect PHP from 5.4.0 through 8.5.11.
Chain A needs an app with any LFI sink, Chain B needs the app to call unserialize(), Chain C needs two directories with different session.serialize_handler settings under PHP-FPM, and Chain D needs nothing beyond a stock Apache mod_php install; all chains affect PHP from 5.4.0 through 8.5.11.Is there a real fix, and does the repo include the worst exploit?The only complete fix is upgrading PHP to 8.2.35/8.3.36/8.4.27/8.5.12+, since the Chain D flaw lives in the Zend engine core and no INI setting patches it; the public repo describes Chain D but doesn't include its exploit code.
The only complete fix is upgrading PHP to 8.2.35/8.3.36/8.4.27/8.5.12+, since the Chain D flaw lives in the Zend engine core and no INI setting patches it; the public repo describes Chain D but doesn't include its exploit code.What's the fastest way to block these attacks without patching PHP?Block the PHPSESSID upload_progress parameter in multipart POST request bodies at the WAF/proxy layer — it has almost no legitimate use and covers the primary attack vector for both CVEs.
Block the PHPSESSID upload_progress parameter in multipart POST request bodies at the WAF/proxy layer — it has almost no legitimate use and covers the primary attack vector for both CVEs.Which real-world platforms are vulnerable?WordPress (via WooCommerce/plugins), Joomla and Drupal are vulnerable because they use native PHP sessions, Magento is vulnerable even in maintenance mode, and Laravel has a known destruct gadget; together these cover 78% of websites.
WordPress (via WooCommerce/plugins), Joomla and Drupal are vulnerable because they use native PHP sessions, Magento is vulnerable even in maintenance mode, and Laravel has a known destruct gadget; together these cover 78% of websites.What makes Chain D the most dangerous?Chain D is a zero-dependency pre-auth RCE against any stock Apache mod_php install — no LFI, no app vulnerability and no authentication required, just a single multipart POST exploiting OOM-triggered Zend engine state corruption.
Chain D is a zero-dependency pre-auth RCE against any stock Apache mod_php install — no LFI, no app vulnerability and no authentication required, just a single multipart POST exploiting OOM-triggered Zend engine state corruption.Who disclosed this and where's the full writeup?Researcher Qi Deng disclosed both CVEs on 2026-10-21 with a detailed writeup on Substack, and Wiz has independently confirmed pre-auth RCE against stock container images.
Researcher Qi Deng disclosed both CVEs on 2026-10-21 with a detailed writeup on Substack, and Wiz has independently confirmed pre-auth RCE against stock container images.What are similar projects?php2shell, php2shell-CVE-2026-109618-CVE-2026-109619-PoC, php2shell-bypass-aslr-exp, dirtyfrag, php_uploadprogress_guard, h4cker, CVE-2026-41940-PoC, CVE-2026-9830
php2shell, php2shell-CVE-2026-109618-CVE-2026-109619-PoC, php2shell-bypass-aslr-exp, dirtyfrag, php_uploadprogress_guard, h4cker, CVE-2026-41940-PoC, CVE-2026-9830Which topics is it in?php-security, detection-engineering, vulnerability-research, poc, exploit-development, application-security, cve, exploit, offensive-security, hacking-tool, red-team, pentesting
php-security, detection-engineering, vulnerability-research, poc, exploit-development, application-security, cve, exploit, offensive-security, hacking-tool, red-team, pentesting