PHP2Shell — TryHackMe Walkthrough

Prefer the deep-dive: https://timiphil9.medium.com/php2shell-how-a-progress-bar-became-unauthenticated-rce-on-14-years-of-php-b21d90a4fd6b?sharedUserId=timiphil9

A task-by-task walk through the PHP2Shell room, with the reasoning behind each answer. The exploitation tasks are explained but not reproduced step-by-step — see the note in Task 5.

23.10.26

Defender’s quick checklist

Patch now — PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart every worker. The only complete fix.

Can’t patch yet? Set session.upload_progress.enabled = 0 and opcache.enable = 0; on PHP 8.5 also fatal_error_backtraces = 0. Restart workers — none is complete alone.

Watch logs for oversized PHPSESSID values in Set-Cookie, multipart POSTs carrying PHP_SESSION_UPLOAD_PROGRESS, and PHP worker crashes / out-of-memory errors.

Won’t help — a mod_php in-process WAF; the attack finishes during request parsing, before your app runs.

Task 1 — Introduction

What this room is about. On 21 October 2026, PHP shipped an emergency release across every supported branch and disclosed two critical vulnerabilities — CVE-2026–109618 and CVE-2026–109619, both scored 9.2 on CVSS v4.0. Together they allow unauthenticated…