UAF RCE exploit via OOM bailout (CVE-2026-109618/109619, no LFI)

Pure memory corruption path: OOM during multipart parsing leaves stale
BG(serialize) state in Apache mod_php prefork workers. Heap spray
reclaims the freed 64-byte slot, giving control of a HashTable's
pDestructor for arbitrary function call.

No LFI, no framework, no non-default PHP settings required.

Tested on PHP 8.3.6 + Apache 2.4.58 (prefork MPM). Confirmed:
- OOM via field flood, worker survival, session file persistence
- Stale BG(serialize).level across requests
- Heap spray targeting ZendMM 64-byte bin

README.md

@@ -34,6 +34,7 @@ against `cleanup=1`, the poisoned session file is includable via LFI for RCE.
 | `bypass/waf_bypass_test.py` | WAF rules | Tests Content-Type evasion against WAF rules |
 | `nolfi/exploit_nolfi.py` | No LFI available | Served save_path + fpm pathinfo — **RCE with no application include** |
 | `fcgi/exploit_fcgi.py` | FPM reachable | FastCGI slow-drip + auto_prepend_file — **RCE, default config, no LFI** |
+| `uaf-rce/exploit.py` | Apache mod_php | OOM → UAF via stale BG(serialize) → heap spray → **RCE, no LFI, no framework** |
 
 ## Prerequisites
 
@@ -157,6 +158,35 @@ python3 fcgi/exploit_fcgi.py --fpm 10.0.0.5:9000 \
 See `fcgi/FINDINGS.md` for the full analysis, test results, and why no
 pool-level configuration can prevent this when FastCGI is reachable.
 
+## UAF RCE (Apache mod_php, No LFI, No Framework)
+
+`uaf-rce/exploit.py` exploits the same CVEs through a pure memory corruption
+path that requires **no LFI, no framework, no libraries, and no non-default
+PHP settings**. The only SAPI requirement is Apache mod_php with prefork MPM
+(default on Debian/Ubuntu).
+
+The attack triggers an OOM during multipart parsing to leave stale
+`BG(serialize)` state in the surviving Apache prefork worker. On the next
+request, the session upload progress handler reuses the stale pointer (a freed
+64-byte ZendMM slot) as a `php_serialize_data` struct. Heap spray reclaims the
+slot with attacker data shaped as a fake `HashTable`, giving control of
+`pDestructor` for arbitrary function call.
+
+```bash
+# Confirm all primitives (OOM, worker survival, session poison, stale state)
+python3 uaf-rce/exploit.py --target http://host:port/index.php --oom-only
+
+# Full chain: OOM + heap spray + UAF trigger
+python3 uaf-rce/exploit.py --target http://host:port/index.php
+
+# With crash detection
+python3 uaf-rce/exploit.py --target http://host:port/index.php --crash-test
+```
+
+PHP-FPM is not vulnerable: workers exit on bailout (code 70), so stale state
+never persists across requests. See `uaf-rce/FINDINGS.md` for the full
+vulnerability analysis and patch details.
+
 ## Patch Bypass Findings
 
 The PHP 8.4.27 patch has three confirmed bypass paths to RCE: