php2shell is a research lab: a reproducible target for CVE-2026-109618 / CVE-2026-109619, plus a read-only audit script for finding whether a host is exposed. It is not a product, and it does not ship anything meant to be exposed to a network.

Both lab targets are Docker containers bound to 127.0.0.1 only:

audit/audit-host.sh is read-only. It starts nothing, writes nothing, sends no exploit traffic, and never triggers an OOM. It is safe to run on a production host.

Use this on systems you own or have explicit written authorization to test. Unauthorized use of the exploit chain against systems you do not control is illegal in most jurisdictions and is not sanctioned by this project. Running the included containers locally is the intended and supported use.

Run the audit script on the host that actually serves PHP:

sudo ./audit/audit-host.sh          # human-readable
sudo ./audit/audit-host.sh --json   # machine-readable

Verdicts, coverage and the reasoning behind them are in audit/README.md.

Quick summary of fixed versions:

Interim mitigation if you cannot upgrade immediately:

session.upload_progress.enabled = Off

If you believe you have found a vulnerability in PHP itself, report it to the PHP project, not here — this repository merely describes an already-published CVE. Use https://github.com/php/php-src/security/advisories/new or the security@php.net address. The upstream advisories for these two issues are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

If you found a bug in this repository's own code — for example the audit script reports a false PATCHED on a genuinely vulnerable host, or the lab containers fail to reproduce — open a regular issue, or a private security advisory via the repository's Security tab if you think the bug is sensitive.

When reporting, please include:

• The PHP version and distribution
• The exact audit-host.sh verdict line, plus --json output if available
• For lab issues, the container name and the full exploit output

In scope:

• Incorrect detection verdicts from audit-host.sh on a real host
• Lab containers that do not reproduce the documented behaviour
• Documentation that states something factually wrong about the CVEs

Out of scope:

• Vulnerabilities in PHP itself (report upstream, see above)
• Reports generated by running the exploit against a system you do not own
• Scanner or WAF vendor claims that they detect this bug class

The core ASLR-bypass technique in php-session-uaf/ is derived from 9bie/php2shell-bypass-aslr-exp and remains the upstream author's work under their own terms. The MIT license on this repository covers the lab targets, Dockerfiles, the audit script, documentation, and the local additions to the chain — it does not re-license that upstream technique.