PHP2Shell Deep Dive

PHP2Shell is a technical walkthrough of an exploit chain involving CVE-2026-109618 and CVE-2026-109619 in PHP. Its central explanation traces a use-after-free to the interaction between session upload-progress handling and out-of-memory error recovery. Upload-progress processing occurs before an application script runs and uses persistent Zend Engine globals; in a long-lived worker, an allocation freed during error handling can leave a pointer that later code still uses. The walkthrough introduces heap reuse and stale-pointer reads and writes to explain how attacker-controlled allocations can make that bug useful.

The exploit is presented as a sequence of HTTP requests against the same worker. It first triggers the memory-management flaw, then grooms the heap to reclaim the freed slot and leak a heap address and a code pointer, defeating address-space randomization. With those addresses, the attacker shapes memory into forged PHP structures - including a HashTable, execution context, and string - and manipulates a destructor pointer. PHP’s own hash-table destruction then follows the forged data and reaches command execution. The author also discusses pointer fingerprinting, locating the relevant heap chunk, allocator-specific calibration, and finding a TCP socket through /proc to return command output. The analysis is based on source-code study and experiments, and emphasizes that exploit details depend on the specific PHP build and heap layout; production conditions make the chain less straightforward.