Exploit catalog

Cron watchdog for PHP-FPM servers: crashed workers, spawned shells, odd connections, new files, persistence. Written for php2shell (CVE-2026-109618/109619).

Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.

Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_progress, on by default since 5.4. Docker A/B (vulnerable vs patched builds), race harness, ASAN proof.

Cloudflare Worker: edge detection + blocking for PHP session.upload_progress RCE (CVE-2026-109618/109619) with Discord alerts — free tier, no KV

PHP CVE-2026-109618/-109619 research archive — default-128M full-chain RCE, Chain B var_destroy UAF alive on 8.4.27, official patch analysis, detection rules

PHP CVE-2026-109618/CVE-2026-109619 universal DoS attack toolkit

PoC and verification material for CVE-2026-109619 (PHP stale worker-global state)

Open eClass 3.15 - RCE

CVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis

Interim guidance for managed WordPress environments following PHP's announcement of critical CVEs CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2). Focuses on upload-progress hardening as risk reduction only. Official PHP updates remain the sole confirmed fix.

The vulneurability causes RCE ending

Defensive awareness site dissecting the php2shell PHP zero-day (CVE-2026-109618 / CVE-2026-109619): why it's critical, who's affected, and how to patch in time.

enactive-systems/CVE-2026-109618-poc

Blue-team detection signatures and interim mitigations for php2shell (CVE-2026-109618/109619) PHP pre-auth RCE pair. Detection and hardening only.

scanner for CVE-2026-109618 / CVE-2026-109619

Mitigation for CVE-2026-109618 and CVE-2026-109619 for PHP under 8.X

Temporary PHP2Shell mitigation for DirectAdmin PHP-FPM servers (CVE-2026-109618, CVE-2026-109619) using Ansible. Includes deployment, verification and rollback.

Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3

Check and apply the php2shell fix (CVE-2026-109618, CVE-2026-109619) on hosts, SSH servers and Docker images

PHP session.upload_progress attack-surface PoC/verification toolkit (php2shell claims, CVE-2026-109618/109619); for authorized lab testing

Minimal PHP session upload progress use-after-free PoC and Docker lab.

zenzue/CVE-2026-109618_19

PHP 5.6.40 with the deb.sury.org security backports (incl. CVE-2026-109618/109619), rebuilt as RPMs for CentOS/RHEL 6 and 7

ASLR-bypassing RCE PoC for PHP's session.upload_progress chain (CVE-2026-109618 / CVE-2026-109619). Single file, no gdb, no /proc - addresses leaked in-band via Set-Cookie. PHP 8.4.26 & 8.5.11.

php7.4 7.4.33-31 (Surý) with php2shell fix CVE-2026-109618/109619, rebuilt for Ubuntu 20.04 focal amd64 — all 38 packages: cli, fpm, mod_php, cgi, mysql, pgsql, gd, intl, curl, xml, zip…

php2shell (CVE-2026-109618, CVE-2026-109619) repo audit, CLI and GitHub Action, no server access. Lists the PHP versions it finds in Dockerfiles, compose, Kubernetes manifests, CI/setup-php and composer.json, in a repo or GitHub org, sorted by what needs the fix or a manual check. Recognizes Laravel Sail, WordPress and Drupal image tags.

No warranties vibecoded scanner for CVE-2026-109618 / CVE-2026-109619

Independent verification lab + PoCs: PHP session.upload_progress pre-auth RCE chains (CVE-2026-109618/109619)

syrex1013/CVE-2026-109619

Docker linux/amd64 build for WordPress 7.1.3 on PHP 8.5.12 FPM Alpine, with fixes for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).