PHP2Shell: Exploit PHP's Upload-Progress Memory Leak (CVE-2026-109618)

What is PHP2Shell?

PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026 by researchers at Calif together with OpenAI and Wiz. PHP runs a large share of the web, so the flaws affected an enormous number of servers. At their core is a memory disclosure: under the right request, a PHP web worker hands back bytes of its own memory to an anonymous attacker. That memory can contain data from other visitors' requests - session tokens, API keys, even private keys. The web-facing fix shipped in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

How this lab works

You are looking at Kartline, a self-hosted PHP storefront running a build of PHP from just before the PHP2Shell patch. Its product-review feature uses PHP's session.upload_progress to drive a live progress bar - exactly the surface the memory disclosure abuses. Working entirely from the Attack Terminal with curl, you will read a live store operator's session straight out of the web worker's memory, replay it to take over the Ops Console, turn an operator-only tool into remote code execution for the user flag, then escalate to root. Nothing is simulated away: the target runs the genuinely vulnerable PHP.

Why practice memory disclosure and session hijacking?

Memory-disclosure bugs are among the most dangerous classes in security - Heartbleed, in 2014, leaked private keys from OpenSSL the same way. A single unauthenticated request that returns server memory can quietly hand an attacker the exact secrets they need to log in as someone else. Reproducing the full chain on HackerDNA builds the instinct to spot a dangerous upload feature, recognize a vulnerable runtime by its version, and understand why keeping PHP patched and running services with least privilege actually matters.