Exploit catalog

Patch-derived PoC and RCE for the PHP session upload-progress pre-RINIT decode (CVE-2026-109618/109619)

Environment checker (for CVE-2026-109618 and CVE-2026-109619)

Guided one-file PHP wizard for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Checks if your PHP is patched, applies php.net’s temporary mitigations with backup & undo. Run: curl -fsSL wasdthedebugger.github.io/php2shell/fix | php

Lightweight, non-intrusive asset scanner designed to audit public and perimeter network assets for vulnerable PHP versions susceptible to php2shell RCE vectors (CVE-2026-109618 / CVE-2026-109619).

Quick and dirty hunting script for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on ISPConfig servers.

Guide, self-assessment form and read-only Linux check script for php2shell (CVE-2026-109618 / CVE-2026-109619): find out if you're exposed, patch, and check whether you were compromised.

Unofficial fix for CVE-2026-109618 / CVE-2026-109619 (php2shell) for the end-of-life PHP 5.4 / 5.3 packages of RHEL, CentOS and Oracle Linux 7 / 6

PoC and verification material for CVE-2026-96652 (Plex Media Server timeline SSRF, owner-token disclosure chain)

Read-only PowerShell scanner: finds PHP installs on Windows hosts and reports PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure. RMM-friendly exit codes and CSV. Tillnet, MIT.

Unofficial security backports for PHP 7.4 on Ubuntu 20.04 (focal): fixes CVE-2026-109618 and CVE-2026-109619 for servers without Ubuntu Pro

Unofficial backport of the official php2shell fix (CVE-2026-109618 / CVE-2026-109619) to PHP 7.3.33. Original fix by Arnaud Le Blanc & Ilija Tovilo (php/php-src).

CVE-2026-109618 PoC - PHP session upload_progress heap UAF to pre-auth RCE. Docker one-liner demo included.

PHP 5.6.40 packages for Debian 7 wheezy with the CVE-2026-109618 / CVE-2026-109619 fix (unofficial rebuild of the jessie packaging)

Fix PHP2Shell (CVE-2026-109618 & CVE-2026-109619) PHP RCE vulnerabilities and automatically convert any WordPress or PHP website to a fast Next.js site.

OpenSSL s_server testing tool for tiny EC private keys for CVE-2026-111943 research.

CVE-2026-109618 out-of-memory audit

Agente de seguridad que detecta y tria php2shell (CVE-2026-109618/109619) en webs y proyectos PHP. Instalable en opencode, Claude Code, Codex, Gemini CLI y otros. Pruebas activas solo con autorización.

Detection + remediation scanner for php2shell (CVE-2026-109618/109619) and react2shell (CVE-2025-55182).

Non-invasive vulnerability assessment for CVE-2026-109618 and CVE-2026-109619.

Safe Nmap NSE detection for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) using PHP version fingerprinting. No exploitation or intrusive probing.

Unofficial PHP 5.3.29 backport of the php2shell fix (CVE-2026-109618, CVE-2026-109619) for Apache mod_php

Kit para diagnosticar y corregir **PHP2Shell** (CVE-2026-109618 y CVE-2026-109619, RCE sin autenticación en PHP 5.4 a 8.5.11) en servidores Linux de clientes.

Detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) PHP RCE exploitation attempts by inspecting POST request bodies with nginx mirror

Patched PHP 8.1 Windows binaries (x64/x86, NTS/TS) fixing critical RCE CVE-2026-109618 and CVE-2026-109619. PHP 8.1 is EOL and php.net ships no Windows build of the fix. Built from the official php-src backport with php-windows-builder; SHA-256 checksums and signed build provenance.

Refactored POC for CVE-2026-109618/109619 php2shell

mbadis-dev/php-cve-2026-109618-toolkit

Interactive Bash audit & remediation tool for PHP2Shell (CVE-2026-109618/109619). Features live Docker inspection, reversible BSI mitigations, and split-screen TUI.

Pre-auth RCE chain for CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress exploitation (PHP 5.4.0–8.5.x)

Check whether a website’s PHP is patched against CVE-2026-109618 / CVE-2026-109619. Works on cPanel ea-php and CloudLinux alt-php without root access

Fast, passive PHP vulnerability scanner in Go for php2shell (CVE-2026-109618 / CVE-2026-109619): subdomain discovery, CIDR scan, CDN/Cloudflare origin bypass, JSON/CSV output.