Exploit catalog

Patched PHP 7.0 RPMs for CentOS 7 (Remi php-* and php70-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an installer that detects the server's PHP, upgrades it and can roll back.

Validation & defense toolkit for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): safe exposure checker, stack-wide mitigations, detection, isolated lab. Defense-first, no weaponized exploit.

Agent plugin to scan, patch, verify and check for compromise after critical PHP vulnerabilities (PHP2Shell CVE-2026-109618/109619).

AmpedWasTaken/PHP2Shell-CVE-2026-109618-CVE-2026-109619

Offline, reproducible lab to safely analyse an untrusted PoC for CVE-2026-109618/109619 and build detection rules. No exploit included; bring your own sample.

No warranties vibecoded scanner for CVE-2026-109618 / CVE-2026-109619

PHP session.upload_progress attack-surface PoC/verification toolkit (php2shell claims, CVE-2026-109618/109619); for authorized lab testing

Paste a Dockerfile, docker-compose, php -v or a package list and see whether your PHP needs the October 2026 fix for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Reads text only.

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Docker lab and PoC. Use-After-Free in PHP's session.upload_progress.

CVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis

initial-access

Interim guidance for managed WordPress environments following PHP's announcement of critical CVEs CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2). Focuses on upload-progress hardening as risk reduction only. Official PHP updates remain the sole confirmed fix.

Unofficial PHP 8.1.34 builds for Linux and Windows with the PHP security team’s PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619), plus build scripts and regression tests.

CVE-2026-109618 / CVE-2026-109619

A working PoC of the PHP2Shell exploit

initial-access

Important: PHP 5.6 is an end-of-life release. This patch should only be considered a security measure after its source changes have been reviewed and tested against the original PHP 5.6.40 codebase. Successful application and verification are required before claiming that either vulnerability is fixed.

PHP2Shell (CVE-2026-109618, CVE-2026-109619): 100% reliable DoS PoC for Apache mod_php, with Docker lab and pcap

Hardens and patches PHP sites you did not build — SAPI-aware mitigation, cache-aware verification, and honest CVE patch tracking. Written for AI agents; php2shell (CVE-2026-109618/109619) is the worked example.

PrestaShop 1.7/8/9 module that mitigates, logs and IP-blocks exploitation attempts of the critical PHP RCE flaws CVE-2026-109618 / CVE-2026-109619, without breaking the cart.

PHP php2shell (CVE-2026-109618, CVE-2026-109619) fixes for Rocky Linux 8, 9 and 10, following AlmaLinux's

Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.

Mitigação temporária para o php2shell (CVE-2026-109618 / CVE-2026-109619): como desabilitar session.upload_progress no PHP em Linux, cPanel, CloudLinux e Plesk, com validação via HTTP. Paliativo até o patch oficial, não substitui a atualização.

Independent PHP2Shell research: CVE-2026-109618/109619 status, source-linked PoC audits, and evidence tracker.

Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets

Initial version of custom CrowdSec rule for CVE-2026-109618 and CVE-2026-109619

PHP CVE-2026-109618/CVE-2026-109619 universal DoS attack toolkit

php5 修复CVE-2026-109618-109619

Read-only audit that finds Cloudflare WAF rules that skip, disable, or downgrade Cloudflare Managed Rules (php2shell CVE-2026-109618/109619).

Independent verification of CVE-2026-109618 & CVE-2026-109619 (php2shell): kernel-proven session-lock-leak DoS on PHP 8.4.24, clean on patched 8.4.27, vendor OOM test suite 5-fail vs 0-fail. Lab, PoC scripts and full results - no weaponized exploit :)