PHP2SHELL
A proof-of-concept exploit chain for CVE-2026-109618 / CVE-2026-109619.
Releasing soon
PHP2SHELL is a security-research proof of concept that chains two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) into remote code execution, with a web interface that streams the steps live as it runs. It's part of the GHOSTSHIELD LABS research work.
The idea
At a high level, the chain starts from a use-after-free in PHP's
session.upload_progress handling to reliably terminate workers, then pivots through
session poisoning and local file inclusion to reach code execution. The write-up and the code
will cover the research in full once it's published.
Coming with the release
- A detailed write-up of the vulnerabilities and how the chain fits together.
- The proof-of-concept itself, with a web UI that streams each stage as it happens.
- Notes on affected versions and how to tell whether you're exposed.
Responsible use
This is published for defenders and researchers: to understand the vulnerabilities, test whether your own systems are affected, and prioritise patching. Only ever use it against systems you own or have explicit written permission to test, and follow coordinated-disclosure practice and local law.
Not out yet. There's nothing to download here yet — this page goes live ahead of the release. Check back soon.