PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

by Adi Gunawan 21 October 2026 4 min read 97x views

PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

Overview

Two cached bucket pointers, one freed tree. A heap use-after-free in PHP session.upload_progress reaching zend_call_function.

PHP's session.upload_progress handler (php_session_rfc1867_callback in ext/session/session.c) caches two raw zval * bucket pointers into live HashTables: post_bytes_processed and current_file_bytes_processed. Both item into arrays that the petition lifecycle frees under the attacker's feet. Press [SOURCE] complete to stroll the complete bundle: the trigger request, the two PoC chains, the extraction harness, and the validated per-build sign deltas.

Stock configuration is enough. session.upload_progress.enabled=1 and the default name, prefix, freq=1%, min_freq=1. A sole accelerated multipart POST arms the two caches; a second update() re-reads the meeting document and zend_hash_update destroys the previous decoded tree through its HashTable destructor zval_ptr_dtor. The freed bucket is then reclaimed and the old pointer lands an attacker-shaped zend_fcall_info / zend_internal_function that calls zend_call_function, ie system().

All of the following is verified against genuine php-src (8.4.4 and 8.2.34): all row citation in the first writeup, the ZVAL_COPY_VALUE no-addref moves, the re-decode/track_init free, and the struct offsets (zend_fcall_info 64B with param_count at +48, zend_internal_function.handler at +88, IS_STRING_EX 0x106, IS_OBJECT_EX 0x308).

The example in this article bakes in per-build delta extraction (--syms) since the offset between zval_ptr_dtor and zend_call_function changes alongside every build. Official LiteSpeed lsphp82 8.2.34 debug symbols provision the exact values for the three distro sub-builds (bookworm 0xc930, noble 0xcef0, jammy 0xd060) and are included below.

php-up-2026 (bundle)/

Click directories to develop · click records to perspective content

choose a document from the tree to inspect source

Usage

How to Validate, Extract & Deliver the Chain

$ python3 php_up_framework.py --selftest # forge + build layout checks

$ python3 php_up_framework.py --syms --binary /path/to/lsphp # extract dtor / call / delta

$ python3 php_up_framework.py --build --bug 619 --dtor <leak> -o body.bin

$ python3 php_up_framework.py --lab --bug 618 --dtor <leak> # php-fpm lab delivery

$ python3 php_up_framework.py --live <target-url> --bug 619 --dtor <leak>

Mitigation (pre-patch)

What to do before the authoritative advisory ships. You can do all of this tonight.

1. Inventory your PHP

Know all presenter and type (php -v). Anything on PHP 7.x or older won't get a fix, so scheme to upgrade.

2. Apply the stopgap (best-intel, low-risk, reversible)

In php.ini / .user.ini / .htaccess:

session.upload_progress.enabled = Off

Reload PHP-FPM or your web server. My inspection says this closes among the two apt paths.

3. Clamp multipart uploads at the edge

The second apt way lives in the multipart parser itself, which runs for any multipart/form-data POST despite of the environment above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the identical network-layer mitigation the endeavor vendors are quietly deploying for their paying customers.

4. Patch the second it drops

Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, verify your provider's timeline today.

Why I'm posting this for free

A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most apt to get burned in the gap between leak and place are the small teams without an endeavor danger intel contract. The steps complete disbursal nothing. Spend tonight reducing risk, not tomorrow doing event response.

I'll prosecute up formerly the authoritative advisory publishes and verify whether my base logic peruse was right, together with Andrew Dorman (@acd421) and Arch&Yuki (@ArchKnight23).