{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-109618",
  "revision": 1,
  "title": "PHP2Shell — Upload-Progress Use-After-Free in PHP",
  "subtitle": "Upload-progress use-after-free",
  "summary": "A use-after-free in the upload-progress handler of the scripting language (PHP) lets an unauthenticated attacker read freed server memory, including passwords and keys, and can lead to RCE. Versions since 5.4 are affected, and attacks began before the patch.",
  "source_type": "cve",
  "severity": "critical",
  "cvss": {
    "score": 9.8,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "cvss_vendor": {
    "score": 9.2,
    "version": "4.0",
    "source": "https://sansec.io/research/php2shell",
    "as_of": "2026-11-04"
  },
  "epss": 0.99999,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "exploit_override": {
      "source": "https://sansec.io/research/php2shell",
      "as_of": "2026-11-04",
      "note": "Public proofs of concept do not work against a default PHP installation."
    },
    "attack_complexity": "low",
    "kev_added": "2026-10-26",
    "kev_due": "2026-10-29",
    "prerequisites": "Network access to a PHP web endpoint and specific conditions on the target; public exploits mostly need a local file inclusion bug in the application."
  },
  "aliases": [
    "PHP2Shell"
  ],
  "affected": [
    "PHP 5.4 and later serving web requests",
    "PHP-FPM",
    "mod_php",
    "php-cgi",
    "FrankenPHP",
    "LiteSpeed"
  ],
  "remediation": {
    "patch_available": true,
    "workaround_available": true,
    "fixed_in": [
      "PHP 8.5.12",
      "PHP 8.4.27",
      "PHP 8.3.36",
      "PHP 8.2.35"
    ]
  },
  "mitre_attack": [
    "T1190"
  ],
  "kill_chain": "initial_access",
  "recommended_action": "Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, then restart PHP-FPM or your web server.",
  "confidence": "medium",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-109618",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-109618",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-109618",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    },
    {
      "fields": [
        "exploitation.exploit_available",
        "exploitation.exploit_override"
      ],
      "source": "https://sansec.io/research/php2shell",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "cvss_vendor"
      ],
      "source": "https://sansec.io/research/php2shell",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "aliases",
        "affected"
      ],
      "source": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "remediation"
      ],
      "source": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    },
    {
      "fields": [
        "aliases",
        "affected"
      ],
      "source": "https://sansec.io/research/php2shell",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "human"
    },
    {
      "fields": [
        "remediation"
      ],
      "source": "https://sansec.io/research/php2shell",
      "retrieved_at": "2026-11-04T14:36:49.943Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109618",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers"
    },
    {
      "type": "writeup",
      "url": "https://sansec.io/research/php2shell"
    },
    {
      "type": "vendor_advisory",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    }
  ],
  "published_at": "2026-10-21T14:17:09.357Z",
  "issued_at": "2026-11-04T14:36:49.943Z",
  "tags": [
    "php",
    "php2shell",
    "use-after-free",
    "memory-disclosure"
  ]
}