CVE-2026-109619: RFC1867 Upload Progress Callback Use-After-Free
Comprehensive security advisory for CVE-2026-109619 (PHP2Shell): affected PHP versions matrix, RFC1867 upload progress Use-After-Free fix, and runtime patch.
Check Your Server Vulnerability Status
Verify if your specific PHP-FPM / CLI build is affected by CVE-2026-109619.
Vulnerability Attributes & Classification
- CVE Identifier
- CVE-2026-109619
- Threat Name
- PHP2Shell
- Vulnerable Component
- ext/session/session.c (php_session_rfc1867_callback)
- Default Exposure
- Vulnerable by Default (session.upload_progress.enabled = On)
- Attack Vector
- Network / Remote (Unauthenticated HTTP POST)
- Official Fix
- commit 1d7dec1 (Arnaud Le Blanc & Ilija Tovilo)
Affected & Secure PHP Versions Matrix
Complete breakdown of PHP runtime versions vulnerable to CVE-2026-109619. Systems running unpatched builds must execute emergency remediation.
| PHP Branch | Vulnerability Status | Patched Version | Mitigation Action |
|---|---|---|---|
| PHP 8.5 | Patched Upstream | 8.5.12 | Upgrade to 8.5.12+ |
| PHP 8.4 | Patched Upstream | 8.4.27 | Upgrade to 8.4.27+ |
| PHP 8.3 | Patched Upstream | 8.3.36 | Upgrade to 8.3.36+ |
| PHP 8.2 | Patched Upstream | 8.2.35 | Upgrade to 8.2.35+ |
| PHP 8.1 (EOL) | Vulnerable (Unpatched) | None | Apply backport commit 1d7dec1 or disable upload_progress |
| PHP 7.0–8.0 | Vulnerable (Unpatched) | None | Must set session.upload_progress.enabled = Off |
| PHP 5.4–5.6 | Vulnerable (Introduced) | None | Must set session.upload_progress.enabled = Off |
Technical Root Cause & Mechanics
CVE-2026-109619 is a Use-After-Free (UAF) condition residing in ext/session/session.c. The upload progress callback caches a raw memory pointer (cached_post_bytes) into the session global state. When request parsing terminates unexpectedly, the underlying buffer is deallocated, but the dangling pointer remains accessible across worker lifetimes, allowing attackers to hijack execution flow.
The flaw triggers before user-space application code ever executes. Application-layer filters, WordPress plugins (Wordfence/Sucuri), and Laravel middleware are physically bypassed because the core C parser handles the stream first.
Step-by-Step Emergency Remediation
Method 1: One-Line Configuration Workaround (Zero Downtime)
Disable upload progress tracking in your global php.ini across CLI and FPM pools:
session.upload_progress.enabled = OffMethod 2: Reload Worker Daemons
Reload the PHP-FPM service to flush running worker pools:
sudo systemctl reload php*-fpm || sudo systemctl restart apache2