php2shell v1.7.0: Complete Bilingual Documentation & Stock Calibration

php2shell Research v1.7.0 — Official Stock Calibration & FastCGI Boundary Update

Key Technical Updates

1. Stock Distribution Image Verification (php:8.4.26-fpm):

   • Demonstrated that the E-OOM controlled write primitive operates identically on official production images (Debian 13 Bookworm/Trixie) without requiring custom debug/symbol builds.
   • Exact measured layout:
     • sapi_module base: 0x555556ae1a00
     • &sapi_module.ub_write: 0x555556ae1a30 (offset +0x30)
     • &system (libc): 0x7ffff7096090
     • Alignment verification: (T2 - d - 0x110) % 16 == 0 strictly satisfied.

2. FastCGI Stdout Isolation Falsification:

   • Confirmed via raw TCP captures that FastCGI suppresses stdout in-band infoleaks (0 leaked pointers in HTTP headers/body upon OOM aborts).
   • Timing side-channel delta ($\Delta = 0.170\text{ ms}$) proven unviable under network jitter.

3. Process-Level Operational Boundary (setarch x86_64 -R):

   • Validated that the execution primitive requires ASLR disabled at the process tree level (ADDR_NO_RANDOMIZE).
   • Under active system-wide ASLR without an auxiliary memory leak, the chain degrades deterministically to a Denial of Service (P3).

4. Bilingual Documentation Harmonization:

   • Synchronized technical findings across English (README.md, REPORT.md, EVIDENCE.md) and Spanish (RESUMEN.md) with zero exploit weapons disclosed.

v1.1.0 — Final Comprehensive Release (3-CVE Taxonomy, StealMyBitcoin Post-Mortem & Diagnostic Tooling)

Summary of v1.1.0 Updates

1. 3-CVE Comprehensive Taxonomy:
   • Explicitly classifies and details CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560 across all technical documentation.
2. StealMyBitcoin Challenge Post-Mortem:
   • SAPI Architecture Disambiguation: Documents empirical findings comparing disposable FastCGI workers (PHP-FPM) vs. persistent HTTP workers (PHP built-in CLI server php -S with PHP_CLI_SERVER_WORKERS=4).
   • Lab-verified reproduction of Chain D (forged HashTable overlapping fake call frame -> zif_system callback with output exfiltration via /proc/self/fd/).
3. Defensive Posture Tooling (tooling/checker/):
   • Non-destructive diagnostic CLI with strict PHPSESSID charset handling and built-in anti-prompt-injection regex guards.
4. Reproducible Lab Environment:
   • Makefile and tooling/docker-compose.yml for immediate side-by-side comparison of vulnerable (8.4.26) vs. patched (8.4.27) baselines.
5. Verified Publication Artifacts:
   • Includes formatted typography release PDFs (php2shell-REPORT.pdf v1.7, 10 pages; php2shell-RESUMEN.pdf, 3 pages) with verified SHA-256 checksums.

php2shell verification v1.0.0 (2026-10-24)

php2shell verification report — v1.0.0 (2026-10-24)

Independent verification of CVE-2026-109618 / CVE-2026-109619 and the follow-up advisory
CVE-2026-115560. Lab-only: official PHP images, loopback traffic, disposable containers. No
production system was touched.

TL;DR

• Pre-auth RCE reproduced in the lab: 3/3 with display_errors=On + ASLR on; 3/3 with
  display_errors=Off + ASLR off (lab 8M override). 8.4.27 control: 0/5.
• The forged-cookie channel discloses heap, not the session table. 47 Zend MM bin-64
  free-list pointers reveal the id chunk base; the session HashTable is never in the window.
  The leak narrows libphp to a 1.88 MB window (~481 pages) with a fixed page offset; it does
  not pin ASLR.
• The Off + ASLR-on route is closed by both tested mechanisms. The leak does not exist on
  FPM (payload A exits the worker), and on mod_php the leak's OOM clears the stale
  BG(unserialize) state that chain E needs.
• post_max_size is not enforced on chunked bodies on unpatched branches (8.2.34, 8.3.35,
  8.4.26 mod_php): a chunked 30 MB multipart parses in full and a chunked 70 MB multipart
  OOMs at defaults. 8.4.27/8.5.12 reject chunked bodies over the limit; FPM does not parse
  chunked bodies; nginx body caps apply.
• Chain D (stale EG + forged zend_object spray): the OOM precondition is confirmed, but
  EG(objects_store), vm_stack and current_execute_data are identical at
  php_request_shutdown before and after the OOM. The stale-EG step is not supported by our
  measurements; only the OOM precondition is.
• CVE-2026-115560: condition reproduced (php_binary config + runtime ini_set() to php
  before session_start()) as a decode failure without a memory-safety symptom. Inconclusive
  until the full advisory is public.

What changed in this revision

1. Corrected the "no leak" claim: the forged cookie does disclose heap; what it never
   discloses is the session HashTable.
2. Corrected the "default limits stop the primitive" boundary: true for Content-Length bodies
   and the published payload sizes; chunked bodies bypass post_max_size on unpatched
   mod_php, and the 8.4.27/8.5.12 patch closes that route.
3. Added the closure of the Off + ASLR-on route (FPM negative + leak/E-OOM exclusivity), the
   chain D EG measurement and the bounded 115560 attempt.
4. Added CVE-2026-115560 to the disclosure timeline and remediation guidance.

Contents

File	Contents
REPORT.md	Full technical report
RESUMEN.md	Executive summary (ES)
EVIDENCE.md	Sanitized lab evidence and matrices (sections 1-12)
validation/	PS(id) vs HashTable matrix and conclusions
detection/	Additive Suricata and Sigma rules
tooling/	oom_reach.py, forged_cookie_check.py, labkit/
raw/	Redacted raw lab captures
POCS.md, COVERAGE.md, METHODOLOGY.md, REMEDIATION.md, FAQ.md, REFERENCES.md	Supporting documents

Defensive guidance

• Patch to 8.4.27 / 8.3.36 / 8.2.35 / 8.5.12.
• Keep stock resource limits; cap request bodies at the proxy (nginx client_max_body_size
  applies to chunked requests; Apache LimitRequestBody defaults to unlimited).
• session.use_strict_mode=1, session.use_only_cookies=1; disable session.upload_progress
  if unused. For CVE-2026-115560, session.upload_progress.enabled=0 until the next regular
  release.
• Deploy the detection rules in detection/ (forged-cookie, groom signatures, abort bursts).

Assets

• php2shell-REPORT.pdf — technical report (EN)
• php2shell-RESUMEN.pdf — executive summary (ES)
• SHA256SUMS — checksums of the assets

Scope and responsible use

This material is for defensive research, patch verification and controlled testing. No exploit
code is redistributed; public PoCs are reviewed by URL in POCS.md. Do not use the described
techniques against systems you do not own or have explicit authorization to test. For
vulnerabilities in PHP itself, follow the PHP project security process.