PHP2Shell - quick mitigation pre-patch

The PHP session.upload_progress feature contains a use-after-free vulnerability (CVE-2026-109618 and CVE-2026-109619) involving the serialize-state cross-request handling in the session upload progress handler. The bug arises because the serialize/unserialize globals are not properly reset before PHP request initialization, leading to reuse of freed memory blocks and arbitrary memory read/write conditions. The cached-pointer path initially thought exploitable is confirmed dead, but the serialize-state UAF remains a real memory safety issue with a CVSS-equivalent severity of 5.3 (medium). This vulnerability affects prefork MPM with mod_php setups and requires specific heap grooming for exploitation. Disabling session.upload_progress in php.ini or .htaccess closes both vulnerable paths. Additional mitigation includes clamping multipart uploads at the network edge. Official patches are planned for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.11.

The vulnerability allows use-after-free memory corruption leading to arbitrary memory read/write primitives but does not enable remote code execution. It can cause application crashes (SIGSEGV) and memory exhaustion. The impact is limited to prefork PHP setups with session.upload_progress enabled and is mitigated by disabling this feature. No active exploits in the wild are reported.

A pre-patch mitigation is to disable session.upload_progress by setting session.upload_progress.enabled=Off in php.ini, .user.ini, or .htaccess and then reloading PHP-FPM or the web server. Additionally, network-layer mitigations such as tightening inspection or rate-limiting multipart/form-data POST requests at the edge (e.g., via WAF or reverse proxy) can reduce exposure. Users should upgrade to the patched PHP versions once available: 8.2.35, 8.3.36, 8.4.27, and 8.5.11. If upgrade is not immediately possible, disabling the vulnerable feature is effective and reversible.