PHP2Shell PoC chains session.upload_progress UAF into unauthenticated RCE

A researcher published PHP2Shell, a proof-of-concept for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2. A heap use-after-free in the session.upload_progress handler enables unauthenticated remote code execution; fixes shipped in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with no backport for branches 8.1 and older.

• Flaws affect PHP 8.2–8.5 at CVSS 9.2; branches 8.1 and older get no patch
• UAF triggers when an upload stalls longer than session.upload_progress.min_freq (1 s)
• PoC ships Docker labs and chains via session poison + LFI, FastCGI and PEAR
• Interim mitigation is disabling session.upload_progress.enabled in php.ini