Daniele Berardinelli

Security Researcher | 20 y.o from Italy

[Daniele Berardinelli @rina4_tot]

@dguido @trailofbits Yeah no fucking way. Now try on a real environment, on fpm-php, with multiple size memory. Replicate the same on any universal php version

[Daniele Berardinelli @rina4_tot]

@kerberoscel What are you talking about? Which part does it sound AI-generated to you?

[Daniele Berardinelli @rina4_tot]

CVE-2026-109618 and CVE-2026-109619 currently have no universal working PoC.

If you want to read the reason 👇

https://t.co/1LbiUEn72I

[Daniele Berardinelli @rina4_tot]

@HackingLZ Thank you Justin! It's a pleasure to get cited by you (:

[Daniele Berardinelli @rina4_tot]

Magento 2.4.9

[Daniele Berardinelli @rina4_tot]

CVE-2026-109618 and CVE-2026-109619 are real and dangerous.

I created a docker with WordPress 7.x, and got RCE.

The build is clean and not edited

If you want to check the hash, read below

I won't share the PoC to the public.

[Daniele Berardinelli @rina4_tot]

@jedisct1 slop slop sahur

[Daniele Berardinelli @rina4_tot]

@J4ck3LSyN Please stop using AI without understanding what are you working on. That LoC is irrelevant.

[Daniele Berardinelli @rina4_tot]

Please don't fall to slop generated exploits. There are no currently public working PoCs on the CVE-2026-109618 and CVE-2026-109619.

The one published by J4ck3LSyN provide no path that makes PHP interpret the sprayed bytes as a callable implementation.

Read more below 👇

[Daniele Berardinelli @rina4_tot]

@JanaJakovl9j Are you retarded? The vulnerability is real, not the public pocs.

[Daniele Berardinelli @rina4_tot]

@Kostastsale Keep calm. The PoC that he released is not working, just pure slop. And no, this remediation won't work.

[Daniele Berardinelli @rina4_tot]

@0xTib3rius @0xTib3rius Sorry, I clearly misstyped the first "if", here:

if ($http_cookie ~* PHPSESSID) {
return 403;
}
if ($args ~* PHPSESSID) {
return 403;

If you want, apply this rule on your server, send me a DM and with your explicit permission I can test my PoC.

[Daniele Berardinelli @rina4_tot]

@DrCronkenstein @MrNiceTry I think this is pretty easy to understand. I have no idea, and can't confirmed if Calif used the same route as I did. The important thing is this: the UAF works (you can test it out), and maybe try with other routes.

[Daniele Berardinelli @rina4_tot]

More details about CVE-2026-109618 and
CVE-2026-109619, the PHP RCE.

Upload progress can serialize before basic RINT clears BG(serialize)

There is currently no possible mitigation.

See the screenshot below to understand how I got the UAF 😼

[Daniele Berardinelli @rina4_tot]

@Dovid UAF on PHP upload progress.

[Daniele Berardinelli @rina4_tot]

@MpFlippy Well yes, it's a UAF now..

[Daniele Berardinelli @rina4_tot]

@MrNiceTry Yeah! no problem (:

[Daniele Berardinelli @rina4_tot]

@StopForumSpam Not really. There are other independent routes which are not session upload progress enabled.