PHP2Shell Deep Dive — CVE-2026-109618 & CVE-2026-109619 OOM to RCE Exploit Analysis

PHP2Shell, a pair of memory-safety flaws tracked as CVE-2026-109618 and CVE-2026-109619, allows an out-of-memory condition in PHP's session handling to escalate into remote code execution via a use-after-free stale pointer, according to a new technical deep dive. The writeup traces how an attacker-triggered OOM during session processing leaves a dangling pointer that can be reclaimed with a forged zend_string struct, the structure PHP reads when building the session cookie. Exploitation requires two separate leaks — a heap pointer and a code pointer — each needing different heap-grooming calibrations, with a multipart_buffer_read_body allocation complicating the layout. The analysis walks through the full chain from the initial HTTP request that triggers the OOM to the final code leak, aiming to be followable by anyone with basic C knowledge. The research is presented as the author's own understanding rather than an official analysis, and the author invites corrections. Next up: watching whether the community confirms the heap-grooming steps and whether the two CVEs see patches or advisories clarifying affected PHP versions.