PHP2Shell: a use-after-free bug in the PHP core
About this app
A concept model of the PHP2Shell use-after-free bugs: a PHP worker shares its memory across requests. When one request runs out of memory and aborts, a global pointer keeps pointing into freed memory; the next request reuses those cells, and the dangling pointer leaks a stranger's password into the PHPSESSID cookie. Step through it and switch the patch on and off.
With explain mode: an AI tutor walks you through the app, points out what matters in the scene and answers your questions.
What PHP2Shell is
PHP2Shell is two security flaws in the PHP core, published on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619, both at the top severity CVSS 9.2 and exploitable without authentication). Both are use-after-free bugs. A PHP worker (PHP-FPM or Apache mod_php) handles many requests one after another in the same memory. If a request aborts with a fatal error, usually because it exceeds memory_limit, the native code ends before it cleans up: the request memory is freed, but a global pointer still points into it. The next request in the same worker treats this now-reused memory as valid.
What the app shows
On the left three requests wait, in the middle a PHP worker with the request memory as a grid of cells, a memory_limit gauge and the global pointer session.upload_progress, on the right the response with the PHPSESSID cookie. In six steps request A fills the memory to the limit, PHP aborts and frees the memory, the pointer dangles, request B (a login) reuses the same cells with a password, and request C (the attacker) triggers the cleanup when it starts. The dangling pointer writes the foreign bytes url-encoded into the cookie — you watch the password land in the attacker's cookie.
Try it yourself
Step through the six steps one by one or play them and watch the pointer, the gauge and the cookie. Switch on "Patched": the pointer is cleared on abort and the cookie stays normal. Turn session.upload_progress off to see a stopgap that closes this one path. Switch from "Read" to "Overwrite" to see the memory corruption of the second flaw instead of the leak. The model only explains the principle — it contains no exploit details.
Frequently asked questions
- What is a use-after-free?
- A program frees a region of memory but keeps using it through an old pointer. Freed only means marked as free and ready to be reused. If something else stores its data there in the meantime, the old pointer reads or overwrites foreign data. That is exactly what happens in PHP2Shell after an out-of-memory abort.
- Does clean application code protect against PHP2Shell?
- No. All known triggers are multipart/form-data requests, and PHP parses this body at the start of the request, before application code runs. The bug is in the PHP core itself, so even an application maintenance mode does not help.
- Which PHP versions are affected and what should I do?
- The flawed code has been in the core since PHP 5.4.0 (2012) and the default configuration is vulnerable. It is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 from 21 October 2026. Updating is the only full fix; you can check the version with php -v or phpinfo through the web server.
- What can I try in the app?
- Select the six steps one by one or play them, switch between read (leak) and overwrite (corruption), compare patched against unpatched PHP, and turn session.upload_progress on and off to see the effect of the stopgap measures on the model.
Subject: Computer science
More from Computer science
- Ackermann function
- Elevator simulator
- Binary workshop
- Binary versus linear search
- The Collatz problem
- Inside a CPU
- Swap the inside
- One frame in 16 milliseconds — how a game engine renders an image (3D)
A VisuApp by heyprof: interactive, free in your browser, no sign-up. What is a VisuApp? · All apps