PHP Pre-Auth RCE Exploiting session.upload_progress

The 'php2shell' disclosure highlights two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting approximately 78% of websites, including major CMS platforms like WordPress, Joomla, and Drupal. These vulnerabilities reside in the PHP core and its session handling mechanism, specifically during the processing of `session.upload_progress` in multipart POST requests.\n\nThe attack chains range from session injection combined with Local File Inclusion (LFI) to zero-dependency RCE that exploits Out-of-Memory (OOM) bailouts in the Zend engine. The most severe chain (Chain D) allows for remote code execution against default Apache mod_php installations without any application-level vulnerabilities or authentication, purely through a single crafted multipart POST body.\n\nDue to the widespread use of PHP and the 14-year range of affected versions (5.4.0 to 8.5.11), organizations are urged to patch immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12+. If immediate patching is not possible, disabling `session.upload_progress.enabled` in the php.ini configuration can significantly reduce the attack surface, although it may not mitigate the core Zend engine OOM corruption in all SAPIs.