Exploit catalog

initial-access

local

local

Exposure scanner for CVE-2026-109618 / CVE-2026-109619 session and upload_progress attack chains on legacy PHP. Single-file, zero-dep Python: remote probes, domain crawl, local audit, XLSX reports. Non-destructive. Authorized use only. Non-commercial license.

Pre-auth RCE chain for CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress exploitation (PHP 5.4.0–8.5.x)

cve explaination

Fast, passive PHP vulnerability scanner in Go for php2shell (CVE-2026-109618 / CVE-2026-109619): subdomain discovery, CIDR scan, CDN/Cloudflare origin bypass, JSON/CSV output.

Lightweight forensic scanner and IOC checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) targeting Debian, LXC, and Docker environments.

Exploit tooling and vulnerability research for CVE-2026-109618 and CVE-2026-109619 — two critical unauthenticated remote code execution (RCE) vulnerabilities patched in PHP 8.4.27, 8.3.36, 8.2.35, and 8.5.12 (released October 21, 2026).

Patched PHP 7.4 packages for Ubuntu 20.04 (focal) fixing CVE-2026-109618 / CVE-2026-109619: Ondřej Surý's 7.4.33-31 rebuilt for focal, with an installer that detects the server's PHP, upgrades it and can roll back.

Exploit tooling and vulnerability research for CVE-2026-109618 and CVE-2026-109619 — two critical unauthenticated remote code execution (RCE) vulnerabilities patched in PHP 8.4.27, 8.3.36, 8.2.35, and 8.5.12 (released October 21, 2026).

initial-access

Sealed PHP 5.6.40+sp1 CLI builds (CVE-2026-109618/109619) for macOS and Windows

Unofficial PHP 5.4.45 backport for CVE-2026-109618 and CVE-2026-109619, validated with ASan, PHPT, and VC11.

Read-only PHP2Shell audit for CVE-2026-109618 and CVE-2026-109619. Discover PHP services and prepare remediation. Linux Bash + Windows PowerShell; EN/PT HTML and CSV reports.

PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

Detection + remediation scanner for php2shell (CVE-2026-109618/109619) and react2shell (CVE-2025-55182).

Corrección de PHP2Shell (CVE-2026-109618 / CVE-2026-109619) para PHP 7.4 en CentOS/RHEL/CloudLinux con cPanel, Plesk o DirectAdmin. Aplica el commit oficial de PHP 712e60f9.

UNTESTED unofficial PHP 5.4.45 Apache/mod_php image with a backport of the php2shell (CVE-2026-109618/109619) mitigation

Fixed PHP versions and distro packages for PHP2Shell (CVE-2026-109618, CVE-2026-109619) as JSON. CC0. Data behind php2shell.fyi.

CVE-2026-114509-POC [Educational Purpose Only]

A plain-language security check for AllStarLink 3 (ASL3) nodes. Checks for the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619), pending updates, exposure, and SSH settings.

Go app using Coraza WAF (CVE-2026-114101 bypass)

Defensive PHP update guidance and local-only verification for CVE-2026-109618 and CVE-2026-109619.

Script para auditar las url en produccion si es vulnerable con el bug CVE-2026-109618 / CVE-2026-109619 — PHP

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — 8-version matrix, Docker labs, and measured boundaries: what works, what does not.

Read-only IOC triage for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). POSIX sh for WordPress, Nextcloud, Laravel, Drupal and plain PHP, on hosts or inside containers.

PHP2Shell Sentinel is an open-source defensive security tool for PHP administrators to assess runtime patch status, review logs, identify suspicious file changes, and investigate potential exploitation indicators related to CVE-2026-109618 and CVE-2026-109619. Built with Bash for authorized, read-only security triage.

Unofficial security backports for PHP 7.4 on Ubuntu 20.04 (focal): fixes CVE-2026-109618 and CVE-2026-109619 for servers without Ubuntu Pro

PHP 5.6 security patch, backports, and mitigations for session.upload_progress Use-After-Free (CVE-2026-109618, CVE-2026-109619).