 ____  _   _ ____    _____ ___    ____  _   _ _____ _     _
|  _ \| | | |  _ \  |_   _/ _ \  / ___|| | | | ____| |   | |
| |_) | |_| | |_) |   | || | | | \___ \| |_| |  _| | |   | |
|  __/|  _  |  __/    | || |_| |  ___) |  _  | |___| |___| |___
|_|   |_| |_|_|       |_| \___/  |____/|_| |_|_____|_____|_____|

Lab target — unpatched PHP core

CVE-2026-109618 & CVE-2026-109619 · session.upload_progress heap UAF · pre-auth, any PHP page

PHP8.5.4

SAPIcli-server

memory_limit8M

upload_progress.cleanupOff

USE_ZEND_ALLOC(unset)

session.upload_progress.enabledOn

name / prefixPHP_SESSION_UPLOAD_PROGRESS / upload_progress_

freq / min_freq1% / 0

uidroot

Dummy upload form. The CVEs fire in PHP core while the multipart body is parsed, before this script runs.