New exploit at fcgi/exploit_fcgi.py combines the session upload progress
write primitive (CVE-2026-109618/109619) with direct FastCGI access to
PHP-FPM. A slow-drip multipart upload holds one FPM worker in the
multipart parser while a second FastCGI request includes the poisoned
session file via auto_prepend_file.
Works on default PHP configuration, no LFI, no framework, no libraries.
security.limit_extensions does not block auto_prepend_file inclusion.
php_admin_value in pool config does not block PHP_VALUE from raw FastCGI.
Tested and confirmed RCE on:
PHP 8.3.6 (local, pre-patch)
PHP 8.3.35 (Docker, pre-patch)
PHP 8.3.36 (Docker, patched)
PHP 8.4.27 (Docker, patched)
Mitigated by session.upload_progress.enabled=0 or blocking FPM access.
Also includes nolfi/ exploit (served save_path + pathinfo routing) from
previous work, and updated README with mitigation matrix for all vectors.
neko
8147ce0edb