Exploit catalog

CVE-2026-111497 – Node.js Brotli Decoder OOB Write (CVSS 9.2) | Red/Blue Team suite for unpatched Node.js 22.x, 24.x, 26.x. 2 tools: Full Exploit (patch detection, remote DoS, Brotli bomb, lab RCE), Blue Team Checker (errno differential, version fingerprint, WAF detection, reporting) Only Use Ethically Only <3

Reads the Brotli decoder inside every Node, Bun, Electron app and AI coding tool on your machine: which still carry CVE-2026-111497. Executes nothing.

utkarsssh17/cve-2026-111497-brotli-poc

Node.js (14 e 20, em fim de vida) com o decoder Brotli corrigido: CVE-2026-111497 (Node2Shell). Não oficial.

One-file PHP check for the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619). No exploit, no network.

Unofficial backports of the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619) to end-of-life PHP 7.0–7.3, with regression-tested patches and rebuilt packages for CentOS 7 (Remi), Debian 10 and Ubuntu 18.04 (Sury).

This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619. PHP is a widely used open-source server-side scripting language, so these vulnerabilities may affect a broad range of internet-facing web applications and products that embed or depend on PHP.

Detection and response package for php2shell (CVE-2026-109618 / CVE-2026-109619): Suricata, Zeek, YARA, Sigma, ModSecurity rules, hunting queries, SOC triage, patch matrix. No exploit code.

Standalone detection probe for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): passive version fingerprint by default, opt-in active crash probe via Nuclei.

Independent reproduction of the Brotli decoder out-of-bounds write behind CVE-2026-111497 (Node2Shell): payload built from first principles, A/B against the patched release, and a measured ceiling that rules out the advertised RCE path.

CVE-2026-111497 brotli decoder firing range (RoE: loopback lab targets only)

Proyecto de explotación.

PHP 8.4.26 - Critical - Remote - OOM longjmp - CVE-2026-109618 PHP2Shell. Unauth chunked multipart hits memory_limit before app code on Apache mod_php. Lab vs 8.4.27. Advisory RCE inferred.

Harmless fingerprint scanner for PHP CVE-2026-109618 / CVE-2026-109619 (CLI + Web UI)

Check if your server is vulnerable for latest PHP2Shell (CVE-2026-109618,CVE-2026-109619, CVE-2026-115560)

Detect php2shell (CVE-2026-109618 / CVE-2026-109619) on remote PHP targets — behavioral multipart probes, version fallback, async CLI in PHP.

A clean, modular, and extensively documented reimplementation of the Assetnote php2shell scanner for detecting CVE-2026-109618 and CVE-2026-109619 in PHP environments.

Check and patch all installed PHP versions against PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Debian/Ubuntu with PHP from Surý (HestiaCP supported)

CVE-2026-109618 (php2shell part 1): local deterministic memory-safety PoC

Reproducible local Laravel lab and self-checking PoC for CVE-2026-114509

Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm

Defensive assessment toolkit for CVE-2026-111497 (Brotli OOB write): ecosystem scanner, Python outbound PoC, canary server, CDN amplification analysis, framework defense matrix

initial-access

CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)

Lab-only exact-profile RCE/DoS validator for CVE-2026-111497; refuses non-loopback targets

Desktop tool to find, audit, and remediate the PHP2Shell CVEs (CVE-2026-109618/109619) on your own infrastructure — network scan, SSH/SFTP checks, guided upgrades, and log analysis.

Lab pembelajaran lokal untuk mereproduksi CVE-2026-109618/109619 pada Docker.

saaudsdk/php2shell-cve-2026-109618-109619-fix

initial-access

Quick Plex2Shell (CVE-2026-96652) exposure & version check — is your Plex Media Server patched (1.43.3.10861+)?