I published PHP2Shell , a proof-of-concept for two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — that enable a heap use-after-free in session.upload_progress and, with the right chain, unauthenticated remote code execution.

For security research and authorized testing only.

Repo: github.com/syrex1013/php2shell

Why this matters

PHP’s multipart upload-progress feature ( session.upload_progress ) is enabled by default in many deployments. The bugs sit in ext/session/session.c and carry a CVSS 9.2 rating. They affect a long range of versions:

Branch Vulnerable through Fixed in

PHP 8.2 8.2.34 8.2.35

PHP 8.3 8.3.35 8.3.36

PHP 8.4 8.4.26 8.4.27

PHP 8.5 8.5.11 8.5.12

PHP ≤ 8.1 all no backport — EOL

If you still run anything at or below those “vulnerable through” lines — especially EOL 8.1 and older — you should treat this as urgent.

Background: the two CVEs

Both issues are heap use-after-free bugs in the rfc1867 upload-progress handler.

The handler caches raw zval* pointers into…