php2shell-poc: CVE-2026-109618/109619 - 5 RCE chains + detection rules (Suricata, Sigma, M

A closer look at php2shell-poc: CVE-2026-109618/109619 - 5 RCE chains + detection rules (Suricata, Sigma, M

What this repository contains

A collection of exploit code, detection rules and writeups for two PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. The repo describes five independent RCE chains that exploit PHP's session.upload_progress and an OOM bailout in the Zend engine.

Included are three exploit chains (A, B, C) in the exploit/ directory, pre-built IDS/WAF/SIEM rules under detection/, and a writeup linked from the page.

What you can actually do here

Read technical details about the five RCE chains and follow detection guidance (Suricata, Sigma, ModSecurity, Snort rules are mentioned).

Use the provided detection rules and mitigation advice, for example blocking PHP_SESSION_UPLOAD_PROGRESS in multipart POST bodies, and read the writeup and links to external analyses (Sansec, Corelight, Wiz).

Note that two of the chains (D and E) and their exploit code are available only to paid subscribers of the writeup; three other exploit chains are included in the repo.

Who will find this useful

Security researchers and defenders who need exploit details and detection signatures for the two CVEs and related PHP pre-auth RCEs.

System administrators and incident responders who want mitigation steps and IDS/WAF rules to detect or block the primary attack vector (session.upload_progress).

Developers maintaining PHP infrastructure who need to know that the only complete fix listed is patching PHP to the referenced patched versions.

Questions people ask about php2shell-poc: CVE-2026-109618/109619 - 5 RCE chains + detection rules (Suricata, Sigma, M

Does the repository include exploit code for all five chains?

Three exploit chains (A, B, C) are included in exploit/, while Chains D and E are provided to paid subscribers of the writeup.

What is the recommended mitigation mentioned on the page?

The fastest mitigation suggested is blocking PHP_SESSION_UPLOAD_PROGRESS in multipart POST bodies; the page states the only complete fix is patching PHP to the listed patched versions.

Which PHP installations are affected according to the page?

The writeup says the vulnerabilities affect many installations from PHP 5.4.0 through 8.5.11 and notes impacts to common apps like WordPress, Joomla, Drupal, Laravel and Magento.

php2shell-poc: CVE-2026-109618/109619 - 5 RCE chains + detection rules (Suricata, Sigma, M was shared on NexURLs by Nexis on October 22, 2026, in Tech & AI.