Exploit catalog

Local exposure auditor for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF). Answers whether YOUR host is exposed, with proof.

cozybear-dev/cve-2026-109619

this is a exploit for CVE-2026-109619

PHP 8.2.6 + Apache mod_php

Independent PHP2Shell research: CVE-2026-109618/109619 status, source-linked PoC audits, and evidence tracker.

PHP CVE-2026-109618/CVE-2026-109619 universal DoS attack toolkit

Reproducer for CVE-2026-85317 — Apache Camel camel-http OAuth2 token cache confusion (CWE-524). Camel Spring Boot.

junaire/CVE-2026-109618-exploit

Reproducer for CVE-2026-91858 — Apache Camel camel-fop XML External Entity (XXE) via a third-party TransformerFactory (CWE-611). Camel Spring Boot + Camel Quarkus.

daffa001/php-CVE-2026-109618-CVE-2026-109619

php2shell (CVE-2026-109618, CVE-2026-109619) repo audit, CLI and GitHub Action, no server access. Lists the PHP versions it finds in Dockerfiles, compose, Kubernetes manifests, CI/setup-php and composer.json, in a repo or GitHub org, sorted by what needs the fix or a manual check. Recognizes Laravel Sail, WordPress and Drupal image tags.

CVE-2026-109618

Mitigations for PHP installs that cannot update yet: CVE-2026-109618 / CVE-2026-109619 (php2shell) and CVE-2026-115560. Edge rules, auth before PHP, request limits, PHP settings. Unofficial. The real fix is updating PHP.

CVE-2026-109618/109619 --- PHP session.upload_progress pre-auth RCE (chain A/B/C)

scanner for CVE-2026-109618 / CVE-2026-109619

Safe, reversible interim hardening for critical PHP vulnerabilities while you wait for patched builds. One opt-in module per advisory, dry run by default, auto rollback, one-command revert. Current: CVE-2026-109618 / CVE-2026-109619 (Oct 2026). Not a fix: update PHP.

Paste a Dockerfile, docker-compose, php -v or a package list and see whether your PHP needs the October 2026 fix for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Reads text only.

Reproducer for CVE-2026-88900 — Apache Camel camel-jgroups unsafe Java deserialization of cluster messages (CWE-502, HIGH). Camel Spring Boot.

Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.

Mitigation for CVE-2026-109618 and CVE-2026-109619 for PHP under 8.X

Safe local and passive remote exposure checker for CVE-2026-109618 and CVE-2026-109619, with a Burp BCheck.

Lab, PoC, ASan research and EOL backport for CVE-2026-109618/109619 (PHP OOM state corruption). Defensive research.

PHP php2shell (CVE-2026-109618, CVE-2026-109619) fixes for Rocky Linux 8, 9 and 10, following AlmaLinux's

Read-only audit that finds Cloudflare WAF rules that skip, disable, or downgrade Cloudflare Managed Rules (php2shell CVE-2026-109618/109619).

Tracking PHP CVE-2026-109618 / CVE-2026-109619: official status, patches, mitigations

AWS WAF (REGIONAL) CloudFormation sample for ALB: block POST from outside Japan, rate-limit POST per IP and per TLS JA4 fingerprint, and return the blocking rule name in the response. Verification sample for the php2shell (CVE-2026-109618/109619) period; not a fix for the PHP vulnerabilities.

🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 — session.upload_progress 文件名注入 + LFI → RCE，Docker 一键启动，附中文原理分析与 PoC

Read-only triage for the Oct 2026 PHP RCE advisory (CVE-2026-109618/109619)

CVE-2026-109618 / CVE-2026-109619 — lab harness, offsets, mitigation verification and write-up (own hosts only)

Detection + mitigation lab for the October 2026 PHP critical release (CVE-2026-109618 / CVE-2026-109619). No exploit code — detection, mitigation testing, and port rehearsal only.