[carlospolop]

Blog URL

https://offsec.com/blog/php2shell-anatomy-of-two-php-lifecycle-bugs

Blog Title

php2shell: anatomy of two PHP lifecycle bugs

Blog high summary

php2shell examines two unauthenticated PHP-core RCEs (CVSS v4.0 9.2): CVE-2026-109618 corrupts a half-built hash table when multipart parsing triggers OOM and longjmp(), while CVE-2026-109619 leaves request-owned worker globals dangling across requests. Both execute before userland; 619 needs a persistent worker and same-worker follow-up request.

It explains mod_php/FrankenPHP impact, confirmed fatal-backtrace and session-upload-progress consumers, the misleading stalled-upload PoC and unproven bundle, fixed releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12, partial mitigations, detection signals, and commit 31c0ea7's delayed-OOM and global-reset fixes.

PR changes

• src/binary-exploitation/php-request-oom-bailout-and-stale-state.md: Added per-part header amplification under multipart memory pressure and clarified the URL-encoded nested-field requirements in the hash-bucket section.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The PHP advisory supports per-part header amplification as a distinct route to memory exhaustion. Datadog’s reproduction supports the URL-encoded field-shape and allocation-order constraints. The existing PHP request-lifecycle chapter is the canonical location. A duplicate closing banner was removed.

Head: 2c3694ebdfa1629b4adc8ccdfd03f910821a820a

[carlospolop]

merge