PHP Multipart Upload-progress Session Handling PHP2Shell Vulnerability Remote Code Execution Exploit

This module exploits CVE-2026-109618, a use-after-free vulnerability in PHP's multipart upload-progress/session handling. When PHP reaches memory_limit during specially structured multipart processing, an abnormal bailout can leave session-related Zend objects dangling in a persistent Apache worker. A later request handled by that same worker can reuse the freed memory, turning the stale references into memory disclosure and, ultimately, code execution, to deploy an OSCI agent. The module first occupies 255 of Apache's 256 prefork workers, forcing every stage onto the same remaining process. Its A1 request triggers the faulty out-of-memory cleanup, and B1 reclaims the stale session identifier with a forged string. Reading that string beyond its legitimate bounds leaks heap and libphp pointers, allowing the module to calculate the heap base, libphp base, and address of PHP's internal zif_system function despite ASLR. A second out-of-memory request, A2, creates another dangling session reference. B2 then sprays the corresponding allocation class with forged zend_reference, zend_array, zend_execute_data, and zend_string objects. The fake array's destructor points to zif_system, while its fabricated call frame supplies the user's command as the function argument. When PHP destroys the reclaimed object, it follows the forged destructor and invokes system(command). The command is stored in the unused tail of a 384-byte heap carrier; after the required structures and NUL terminator, this provides a validated maximum of 231 command bytes. The chain is layout-specific and was calibrated for the controlled PHP 8.4.26 Apache-prefork environment.