Core Conclusion: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a critical PHP remote code execution vulnerability with CVSS score of 9.2 . Replicating it in a controlled environment is technically feasible, but it must be strictly confined to Docker containers or local virtual machines bound only to 127.0.0.1. Performing any form of verification against production environments, UAT environments, or unauthorized targets not only carries extremely high technical risks (potential worker process crashes, memory corruption, or accidental persistence) but may also constitute a criminal offense in most jurisdictions.
⚠️ Legal and Ethical Disclaimer (Read Before Proceeding)
Only test systems you own, or systems for which you have obtained explicit written authorization.
Unauthorized access to computer systems is a criminal offense in itself in most countries, regardless of your intentions, regardless of whether damage is caused, and regardless of whether you later report the discovered issues. Applicable laws include but are not limited to: the Computer Fraud and Abuse Act (CFAA) in the United States, the Computer Misuse Act 1990 in the United Kingdom, the Information Technology Act 2000 in India, and equivalent legislation in other jurisdictions .
Even when testing your own assets, “I own this server” does not mean “I can do anything”:
- If the server is provided by a cloud vendor (such as AWS), you must also comply with the vendor’s penetration testing policies.
- If the system contains any real user data, additional privacy regulations (such as GDPR) may apply.
- If you are an employee, employment relationship does not constitute authorization; you must obtain written approval from someone with authority .
Red lines for this article: All operations described below must only be performed on local Docker containers or virtual machines that you fully control and that are completely isolated from the internet. Never point the payloads in this article at any IP address or domain name that you do not own or have not obtained explicit written authorization to test.
AWS-Specific Legal Notes
AWS allows customers to conduct security assessments on permitted services (including EC2, ELB, RDS, etc.) without prior approval. However, AWS’s penetration testing policy applies to all testing conducted on AWS, including internal tests against your own environment . If you are using an EC2 instance in AWS for replication, please note:
- If the test traffic is confined within the VPC and does not trigger external abuse flags, the risk is relatively low. However, if the tool generates outbound traffic, the same architectural guidance still applies .
- Testing involving Command and Control (C2) requires prior approval .
- Do not use AWS infrastructure or AWS services themselves as test targets; you may only test the resources you own .
- If you plan to conduct testing on AWS, it is recommended to notify your account team of the static scanning IP addresses to prevent false-positive abuse flags .
However, the safest approach is: do not replicate PHP2Shell on AWS UAT at all. Use a local Docker container instead. This completely avoids the risk of violating cloud vendor policies or accidentally exposing the vulnerability.
🐳 Recommended Approach: Use a Local Docker Lab
The PHP security community has released multiple isolated Docker reproduction environments. The following are two representative options:
Option 1: ChatBug (Non-Destructive Verification, Recommended for Beginners)
ChatBug is an authorized website vulnerability verification toolkit that focuses on PHP2Shell. Its core principle is: do not send OOM/UAF crash payloads, do not execute commands on production, and do not provide reverse shells .
What it can do: Determine from outside whether your own website’s PHP version is within the affected range, and confirm whether the upload parsing entry point is reachable. It sends only HEAD requests and normal multipart requests, without executing any commands or touching production data .
Local isolated reproduction (no Docker, no root, no network required):
pip install ChatBug
chatbug php2shell lab local-listThis command runs a test case entirely in memory, verifying the basic logic of the session upload-progress chain. Successful output includes accepted: true and marker file content .
Docker-isolated reproduction (requires a host with Docker via SSH):
chatbug php2shell lab docker-list --ssh-host <your-ssh-host>This command pulls a pinned-digest PHP-FPM image, creates an internal Docker network (no host ports published), and runs fixed ls/cat commands only within the lab. Upon completion, it automatically cleans up all containers and networks .
Important: The chain reproduced by ChatBug’s
docker-listis the traditional “PHP include file inclusion chain,” which only proves that RCE can be achieved when an “affected PHP runtime + application with an LFI gadget” condition is met. It does not independently prove the memory corruption RCE of CVE-2026-109618/109619 .
Option 2: Nayrae/CVE-2026-109618 (Demonstrates Session Handler Mismatch Chain)
This repository provides a Dockerfile based on PHP 8.2 + Apache, demonstrating how to achieve command execution through session handler inconsistency (php_serialize vs default php) combined with specific configuration .
Key configuration items (for understanding the principles):
# Build and start (bind only to 127.0.0.1)
docker build -q -t php2shell-lab .
docker run -d --name php2shell-lab -p 127.0.0.1:8080:80 php2shell-lab
# Run exploit
python3 rce.py 127.0.0.1 8080 "id"🔬 Key Prerequisites for Vulnerability Triggering
To successfully reproduce PHP2Shell (at least the session upload-progress chain), the environment must satisfy the following conditions:
- Affected PHP version: PHP 8.2.x < 8.2.35, 8.3.x < 8.3.36, 8.4.x < 8.4.27, 8.5.x < 8.5.12. PHP 5.4 and later are all potentially affected by at least one of the vulnerabilities .
session.upload_progress.enabled = On(enabled by default).- Application has an LFI (Local File Inclusion) gadget, or an exploitable session handler mismatch condition exists.
- For the mod_php scenario: Apache prefork mode + mod_php is the officially validated worst-case scenario (default configuration allows unauthenticated RCE) .
🛡️ Security Boundaries for the Lab Environment
| Measure | Requirement |
|---|---|
| Network binding | Must be 127.0.0.1, never 0.0.0.0 |
| Data | Only synthetic data, no real credentials, user data, or database content |
| Persistence | Containers should be disposable; delete immediately after testing |
| Snapshot | If using a VM, take a snapshot before proceeding |
| Logging | Record all test operations for audit purposes |
📌 If You Find the Vulnerability in an Unauthorized System
If you inadvertently discover PHP2Shell is exploitable while testing a system you do not own:
- Stop testing immediately, do not “confirm impact” further.
- Do not access, copy, or retain any data.
- Look for a security contact (such as
/.well-known/security.txt), and report following their policy. - Consider your own legal exposure; for significant findings or situations where the organization may react negatively, seek legal advice first .
Summary
PHP2Shell is a real, actively exploited critical PHP remote code execution vulnerability (CVSS 9.2) affecting PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35, caused by use-after-free and memory corruption flaws in the PHP engine that can lead to unauthenticated RCE, particularly in Apache mod_php deployments. But “being able to reproduce it” does not mean “you should reproduce it anywhere.” The correct approach is: reproduce and understand PHP2Shell in an isolated local Docker container or PHP2Shell lab using repositories like ZeroHackOrg/php2shell-poc or Nayrae/CVE-2026-109618, verify your own systems using non-destructive detection tools such as ChatBug web check, php2shell-guard, or php2shell-ioc-check, and if you truly need to test on AWS, first read the AWS penetration testing policy and ensure all activities are within the permitted scope under laws like the CFAA, Computer Misuse Act 1990, and IT Act 2000 India, obtaining proper written authorization and following responsible disclosure practices. Whether you are searching for PHP2Shell exploit, PHP2Shell PoC, CVE-2026-109618 PoC, PHP session upload progress vulnerability, PHP deserialization, PHP webshell detection, PHP2Shell patch, PHP2Shell mitigation, or PHP2Shell tutorial as a newcomer, the key principle remains: the safest replication is the one that never touches any real system.