Exploit catalog

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Docker lab and PoC. Use-After-Free in PHP's session.upload_progress.

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

AmpedWasTaken/PHP2Shell-CVE-2026-109618-CVE-2026-109619

Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules

Temp fix with Ansible (CVE-2026-109618/CVE-2026-109619)

php2shell (CVE-2026-109618, CVE-2026-109619) repo audit, CLI and GitHub Action, no server access. Lists the PHP versions it finds in Dockerfiles, compose, Kubernetes manifests, CI/setup-php and composer.json, in a repo or GitHub org, sorted by what needs the fix or a manual check. Recognizes Laravel Sail, WordPress and Drupal image tags.

CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework)

Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.6-8.5; Sury, cPanel EA4, DirectAdmin, Docker, Windows.

zenzue/CVE-2026-109618_19

Ansible Playbook that runs through your PHP-FPM and OpenLiteSpeed PHP files and applies a mitigation against CVE-2026-109619.

Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_progress, on by default since 5.4. Docker A/B (vulnerable vs patched builds), race harness, ASAN proof.

Check and apply the php2shell fix (CVE-2026-109618, CVE-2026-109619) on hosts, SSH servers and Docker images

Temporary PHP2Shell mitigation for DirectAdmin PHP-FPM servers (CVE-2026-109618, CVE-2026-109619) using Ansible. Includes deployment, verification and rollback.

A working PoC of the PHP2Shell exploit

Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no dependencies, no exploit payloads.

Mitigation for CVE-2026-109618 and CVE-2026-109619 for PHP under 8.X

scanner for CVE-2026-109618 / CVE-2026-109619

php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discovery, SAPI profiling, OOM fuzzing calibration, and FPM worker pinning. Stdlib only.

Local exposure auditor for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF). Answers whether YOUR host is exposed, with proof.

Defensive awareness site dissecting the php2shell PHP zero-day (CVE-2026-109618 / CVE-2026-109619): why it's critical, who's affected, and how to patch in time.

PHP php2shell (CVE-2026-109618, CVE-2026-109619) fixes for Rocky Linux 8, 9 and 10, following AlmaLinux's

enactive-systems/CVE-2026-109618-poc

Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3

The PHP Patch: PHP2Shell (CVE-2026-109618, CVE-2026-109619) explained — meaning, who is exposed, how to fix

Ubuntu PHP2Shell (CVE-2026-109618 / CVE-2026-109619) package updater and patch verification

php2shellscanner

junaire/CVE-2026-109618-exploit

Defensive probe for the PHP multipart parser vulnerability CVE-2026-109618 · CVSS 9.2 CVE-2026-109619 PHP < 8.3.36 / 8.4.27

Read-only checker for php2shell (CVE-2026-109618 / CVE-2026-109619): audit PHP servers and websites, no exploit payloads

CVE-2026-109618 / CVE-2026-109619 — unauthenticated RCE in PHP's session.upload_progress handler (CVSS 9.2). Reproducible Docker lab against stock WordPress and Laravel on PHP 8.4.26, plus a read-only on-host audit script.