eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

选用指南

AI 根据 README 整理 · 2026/10/21 19:46:01

使用方式

提供命令行脚本用于快速修复，以及源代码补丁和各类服务器配置示例。

查看 README 依据

#### 2. Automated Quick-Fix Script A mitigation helper script is available under the [`quick-fix/`](quick-fix/) directory: - **Check Current Status:** ```bash sudo ./quick-fix/run.sh --check ``` - **Apply Mitigation (Dry Run):** ```bash sudo ./quick-fix/run.sh --dry-run ``` - **Apply Mitigation:** ```bash sudo ./quick-fix/run.sh ``` - **Revert Changes:** ```bash sudo ./quick-fix/run.sh --revert ``` #### 3. Source Code Patch (`session-upload-progress-counters.patch`)

If you build PHP from source or maintain custom distribution packages, a C-level source patch is provided under [`patch/session-upload-progress-counters.patch`](patch/session-upload-progress-counters.patch). **What the patch fixes:**

部署要求

需要受影响的PHP环境，修复脚本需要sudo权限。

查看 README 依据

The vulnerability relies on PHP's session upload progress mechanism (`session.upload_progress.enabled`), which is enabled by default. Disabling this directive neutralizes the attack vector while preserving regular file upload functionality: In your `php.ini`: ```ini session.upload_progress.enabled = Off ``` Or for PHP-FPM pool configurations (e.g., `/etc/php/*/fpm/pool.d/www.conf`): ```ini php_admin_flag[session.upload_progress.enabled] = off ``` After modifying the configuration, reload/restart your web services (e.g. `systemctl reload php-fpm` or `systemctl reload apache2`).

#### 2. Automated Quick-Fix Script A mitigation helper script is available under the [`quick-fix/`](quick-fix/) directory: - **Check Current Status:** ```bash sudo ./quick-fix/run.sh --check ``` - **Apply Mitigation (Dry Run):** ```bash sudo ./quick-fix/run.sh --dry-run ``` - **Apply Mitigation:** ```bash sudo ./quick-fix/run.sh ``` - **Revert Changes:** ```bash sudo ./quick-fix/run.sh --revert ``` #### 3. Source Code Patch (`session-upload-progress-counters.patch`)

已知限制

PoC仍在开发中，尚未发布；官方仅对支持的PHP 8分支提供补丁，EOL版本无官方修复。

查看 README 依据

- **Impacted Versions:** Reports indicate PHP versions 5, 6, 7, and 8 may be affected. Fixes are primarily expected for currently supported PHP 8 branches, leaving end-of-life (EOL) versions (PHP 5.x, 7.x, 8.0, 8.1) exposed without official vendor patches. - **Industry Tracking:** Confirmed by security researchers (watchTowr reproduced CVE-2026-109618; monitoring by Huntress and Florian Roth / process-watcher). #### Root Cause

- If suspicious child processes or unexpected files are detected, isolate the host and preserve web server/PHP logs. - Inspect web roots and temporary directories (`/tmp`, `/var/tmp`) for dropped webshells or transient execution artifacts. --- ### Proof of Concept (PoC) This repository is dedicated to security research and Proof-of-Concept (PoC) development for **php2shell (CVE-2026-109618 / CVE-2026-109619)**. The PoC exploit is currently being developed and tested. The code will be published in this repository very soon.