RedSide Security has released an open-source security research toolkit for PHP2Shell, providing cybersecurity professionals with a realistic Docker-based testing environment, a non-destructive vulnerability scanner, and a blind remote code execution verifier.
The project focuses on CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities collectively known as PHP2Shell. Both vulnerabilities received a CVSS 4.0 score of 9.2 and affect PHP's core memory management and request-processing mechanisms.
Unlike conventional vulnerability write-ups, RedSide Security's research project provides practical tools for reproducing, investigating, and validating the vulnerabilities in authorized environments.
Project: RedSide Security PHP2Shell Toolkit
What Is PHP2Shell?
PHP2Shell refers to two critical vulnerabilities affecting the PHP runtime that can potentially enable unauthenticated remote code execution.
The vulnerabilities involve memory-management failures that can allow attackers to manipulate PHP's internal state under specific conditions.
The implications are significant: a vulnerable PHP server may process a specially crafted HTTP request that triggers code execution without requiring authentication.
However, successful exploitation is not necessarily straightforward. Reliable exploitation can require precise knowledge of the target's PHP version, binary offsets, memory layout, and runtime configuration.
What's Included in RedSide Security's Open-Source Toolkit?
The project provides several components designed for security researchers, penetration testers, system administrators, and security teams.
1. Realistic Docker-Based PHP Laboratory
A reproducible laboratory environment covering four PHP branches:
- PHP 8.2
- PHP 8.3
- PHP 8.4
- PHP 8.5
The environment is designed to reflect realistic PHP deployments rather than artificially simplifying the exploitation process.
2. Non-Destructive Vulnerability Scanner
The toolkit includes a scanner intended to identify potentially exposed PHP environments without destructively modifying target systems.
It supports preliminary security assessments and helps administrators prioritize further investigation.
3. Blind Remote Code Execution Verifier
One of the project's central components is a blind verification mechanism that demonstrates command execution without writing files to the server or exfiltrating data.
The verifier uses execution timing as evidence of successful code execution.
For example, a deliberately delayed command can provide a measurable signal without producing a file-based artifact.
This is particularly useful for authorized penetration testing, where minimizing changes to production systems is important.
4. Binary Offset and Exploitation Research Tools
The toolkit includes tooling for investigating PHP binary offsets and reproducing the vulnerability in controlled environments.
Reliable exploitation depends on several target-specific factors, including:
- Exact PHP binary builds
- Internal function offsets
- Heap memory layout
- Address Space Layout Randomization (ASLR)
- PHP worker configuration
The tools help researchers understand why exploitation may succeed in one environment but fail in another.
5. Technical PHP2Shell Explainer
RedSide Security has also published a technical explanation of the exploitation process, including PHP array cleanup, use-after-free behavior, memory disclosure, and the constraints involved in achieving remote code execution.
The research explains why the demonstrated payload layout provides only 14 bytes of usable command space and why this limitation does not eliminate the underlying security impact.
A Realistic Lab Without Artificial Exploitation Shortcuts
A distinguishing aspect of the RedSide Security project is its focus on realistic exploitation conditions.
Some demonstration environments simplify exploitation by introducing unrelated weaknesses or modifying the filesystem to make code execution easier.
Examples include:
- Mounting shared directories between a container and the host
- Creating world-writable directories
- Introducing an additional local file inclusion vulnerability
- Using filesystem permissions that would not normally exist on a production server
RedSide Security's laboratory is designed to avoid these shortcuts.
Instead, the objective is to demonstrate the vulnerability through the exploitation mechanism itself, with evidence arising directly from the affected PHP runtime.
This approach provides a more useful environment for understanding actual exploitability and testing defensive controls.
Technical Research: Why PHP2Shell Exploitation Is Difficult
Although PHP2Shell can produce unauthenticated RCE, a working exploit requires several conditions to align.
The RedSide Security research describes five major stages:
| Stage | Description |
|---|---|
| Memory grooming | Arrange PHP heap allocations into a predictable state |
| Vulnerability trigger | Trigger the memory-management flaw |
| Address disclosure | Obtain relevant heap and PHP library addresses |
| Internal structure manipulation | Construct the required memory structures |
| Execution verification | Confirm code execution in the controlled environment |
Modern operating systems use protections such as ASLR to make memory addresses unpredictable.
Consequently, an exploit may require memory disclosures and offsets specific to the exact target build.
Differences in PHP versions, compilation options, system libraries, and worker behavior can significantly affect exploit reliability.
The 14-Byte Command Constraint
RedSide Security's technical research documents a particularly interesting limitation of the demonstrated exploit.
The memory structure used by the exploit occupies a fixed 167-byte allocation.
Within that allocation, several internal structures consume most of the available space.
The remaining area provides only 14 usable bytes for the command, plus a null terminator.
This limitation makes the exploit more challenging but does not necessarily prevent successful code execution.
The research demonstrates how the restricted command space can still support non-destructive execution verification.
Laboratory Validation Results
RedSide Security documented blind timing-based code execution verification across multiple vulnerable PHP releases.
| PHP Version | Laboratory Result |
|---|---|
| PHP 8.2.34 | No RCE confirmation through the tested chain |
| PHP 8.3.35 | RCE confirmed |
| PHP 8.4.26 | RCE confirmed |
| PHP 8.5.11 | RCE confirmed |
The verification experiments were conducted in an authorized, controlled laboratory environment.
The demonstrated results used timing-based confirmation without dropping files or extracting data.
These findings should not be interpreted as proof that every publicly exposed PHP server is exploitable using the same technique. Real-world success depends on the target's configuration, binary layout, and other environmental conditions.
Who Can Use the Toolkit?
The project is intended for:
- Penetration testers: Validate vulnerabilities during authorized security assessments.
- Security researchers: Study PHP memory corruption and exploitation constraints.
- Blue teams: Understand exploitation behavior and improve detection strategies.
- System administrators: Investigate potential exposure and verify remediation.
- Cybersecurity trainers: Build practical demonstrations of memory-safety vulnerabilities.
All testing should be performed only against systems owned by the tester or where explicit authorization has been granted.
How to Protect Against PHP2Shell
The recommended remediation remains straightforward: update PHP to a fixed release immediately.
| PHP Branch | Patched Version |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Administrators should also restart affected PHP workers, verify the version actually used by web-facing services, and review logs for suspicious errors or unexpected worker crashes.
Testing tools can help assess risk, but they do not replace patch management.
Open Source and Community Feedback
The PHP2Shell toolkit is available as an open-source project and remains under active development.
RedSide Security welcomes technical feedback, bug reports, and contributions from the cybersecurity community.
Explore the project: https://github.com/RedSideSecurity/php2shell
Contact: [email protected]
Conclusion
PHP2Shell demonstrates how memory-management weaknesses in widely used application runtimes can lead to serious security consequences.
With its open-source laboratory, non-destructive scanner, blind verifier, offset research tools, and technical documentation, RedSide Security aims to make PHP2Shell research more accessible, reproducible, and useful for defensive security teams.
The project emphasizes realistic testing, transparent limitations, and responsible security research.
Research and testing are valuable, but patching remains the most effective protection.
Developed by RedSide Security. For authorized security testing and educational purposes only.
