[remote] PHP2Shell (CVE-2026-109618)

A research exploit chain targets PHP 8.5.11 running on Apache with modphp, specifically utilizing two memory-safety vulnerabilities to achieve Remote Code Execution (RCE). The first stage leverages CVE-2026-109619 to cause a session-state disclosure via an Out-of-Memory (OOM) bailout, allowing an attacker to leak memory addresses through a forged session cookie. The second stage employs CVE-2026-109618, using multipart amplification to exhaust the heap and trigger an incomplete state during cleanup, which facilitates a ROP chain leading to system command execution.
The exploit is highly environment-specific, requiring precise offsets and heap geometry calibrated for a specific Ubuntu build of Apache 2.4.66 and glibc 2.43. It utilizes advanced delivery techniques, including worker discovery, prefork saturation, and a "worker scrub" to ensure the exploit stages occur within the same process. Patches for these vulnerabilities were released in the PHP 8.5.12, 8.4.27, 8.3.30, and 8.2.29 lines.

* Target software: PHP 8.5.11 NTS, Zend Engine 4.5.11.
* Target environment: Apache 2.4.66 (Ubuntu) modphp/prefork on x86-64.
* Dependencies: glibc 2.43 (Ubuntu 2.43-2ubuntu2.4) and Linux kernel 7.0.0-38-generic.
* Vulnerabilities used: CVE-2026-109619 and CVE-2026-109618.
* Validation date: 2026-10-23.
* Memory limit: 128 MiB.
* Primary objective: Remote Code Execution (RCE) via zifsystem.
* Fix source: php-src commit 506e87fa7dcdd306975e5b8f8265ee03527aacbf.
* Patched versions: PHP 8.5.12, 8.4.27, 8.3.30, and 8.2.29.
* Exploit mechanism: Pure-HTTP delivery utilizing multipart amplification and session-state OOM.

This is a technical research write-up and proof-of-concept (PoC) for a critical vulnerability chain. It functions as a high-fidelity educational resource for security researchers, detailing the intersection of memory management and request lifetimes in the Zend Engine.
The strength of this work lies in its extreme transparency regarding environmental dependencies. By providing SHA-256 hashes for binaries and specific compiler flags, the author avoids the common pitfall of presenting a "magic" exploit, instead modeling the rigorous process of calibration and verification. It acknowledges its lineage, crediting multiple researchers (9bie, Cookiengineer, dinosn), which frames the discovery not as a solitary event but as a cumulative scientific effort.
The underlying paradigm is one of "mechanical empathy"—the need to understand the exact state of a process's heap and the timing of its cleanup to bypass modern protections like ASLR. It highlights a persistent systemic fragility: the gap between a high-level language's memory safety promises and the underlying C implementation's handling of exceptional states (like OOM).
Human agency is centered here on the researcher's ability to reverse-engineer and the administrator's need for timely patching. The primary benefit is the hardening of the PHP ecosystem through the exposure of these edge cases.
Bridge Questions:
1. How do "bailout" mechanisms in memory managers create predictable states that attackers can weaponize?
2. In a containerized environment, would the "worker scrub" and prefork saturation techniques be more or less effective than in a traditional VM?
3. What structural changes in the Zend Engine could eliminate the possibility of request-owned globals outliving their backing heap?
Counterstrike Scan: If this were an influence campaign, a bad actor would omit the calibration details and environmental requirements to make the vulnerability seem ubiquitous and "unpatchable," driving panic and the sale of a proprietary "protection" tool. The actual content does the opposite by emphasizing how specific and fragile the exploit conditions are. Clean.