ikow/php2shell-poc

Maintainer? Show your league in your README

Card: your league's emblem, from Copper to Legendary

[![bestofgithub](https://bestofgithub.dev/badge/ikow/php2shell-poc.svg?style=card)](https://bestofgithub.dev/repo/ikow/php2shell-poc)

Flat: fits beside your other badges

[![bestofgithub](https://bestofgithub.dev/badge/ikow/php2shell-poc.svg)](https://bestofgithub.dev/repo/ikow/php2shell-poc)

Loading README…

CVE	GHSA	CVSS	Description
CVE-2026-109618	GHSA-w8hw-w9fx-j79w	9.2	OOM → `longjmp()` leaves Zend engine state invalid → RCE
CVE-2026-109619	GHSA-6wmf-4rv5-p3rp	9.2	Stale global state across FPM worker requests → UAF → RCE

Chain	Vector	Pre-auth	Conditions	SAPI
A	Session injection + LFI	Yes	App has any LFI sink	All
B	var_destroy UAF → handler overwrite	No	App calls `unserialize()`	All
C	Handler mismatch → `__destruct`	Yes	Two dirs with different serialize_handler	FPM
D	OOM corruption → stale `EG()`	Yes	None — any endpoint	mod_php
E	FPM session OOM → stale `BG()`	Yes	Producer: any `session_start()` endpoint; Consumer: any endpoint	FPM

File	Chain	What It Does
`chain_a_session_lfi.py`	A	Injects PHP code via upload filename → LFI includes session file → RCE
`chain_b_uaf_rce.php`	B	var_destroy UAF → discovers `zif_system` via EG() → overwrites `var_dump` handler via `/proc/self/mem` → RCE
`chain_c_mismatch_rce.py`	C	Pollutes FPM worker `PS(serializer)` → injects serialized object via filename → `__destruct` fires on decode failure → RCE

File	Format	Signatures
`php2shell.rules`	Suricata / Snort	13 rules — request, response, and recon
`php2shell.yaml`	Sigma	5 rules — web logs, process creation, file events
`modsecurity.conf`	ModSecurity v2/v3	7 rules — drop-in for Apache/Nginx
`php2shell.lua`	OpenResty Lua	Lightweight reverse proxy module

Platform	Vulnerable	Notes
WordPress	Yes	Core doesn't use PHP sessions, but WooCommerce and many plugins do
Joomla	Yes	Uses native PHP sessions by default
Drupal	Yes	Uses native PHP sessions by default
Magento	Yes	Vulnerable even in maintenance mode
Laravel	Yes	`PendingBroadcast` is a known `__destruct` gadget
Roundcube	Yes	Webmail — credential exposure risk
phpMyAdmin	Yes	Direct database access
Nextcloud	Yes	File storage system
Symfony	Yes	Framework-level exposure
MediaWiki	Yes	Wiki platform
WooCommerce	Yes	WordPress plugin; payment data at risk
Shopware	Yes	E-commerce platform
WHMCS	Yes	Hosting control panel

php2shell