Injection: PHP - var_destroy Use-After-Free (php2shell)¶

Identifier: cve_2026_109619

Scanner Support¶

Description¶

PHP builds in 5.4.0 through 8.2.34, 8.3.0 through 8.3.35, 8.4.0 through 8.4.26, and 8.5.0 through 8.5.11 are flagged for the php2shell var_destroy use-after-free (CVE-2026-109619). The bug is reachable when the application unserializes attacker-controlled data and an object with a destructor that re-enters the unserializer exists, which can lead to code execution. PHP 5.x, 7.x, 8.0, and 8.1 are end-of-life and receive no official fix.

How we test: We fingerprint the PHP version from the X-Powered-By response header and flag builds inside the affected ranges. This is a version check only: it can't confirm the required unserialize sink or destructor gadget from the network, the fix status of the php2shell research should be confirmed against the PHP release notes before relying on these boundaries (releases above them may still be affected), and distributions that backport security fixes may report an older upstream version while already being patched.

Reference:

• https://github.com/Ademking/php2shell-nuclei-templates
• https://github.com/ikow/php2shell-poc
• https://github.com/ikow/php2shell-poc/blob/main/docs/ANALYSIS.md
• https://www.php.net/archive/2026.php

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cve_2026_109619:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.