Catálogo de exploits

Find every PHP version your repositories pin, and what PHP2Shell (CVE-2026-109618, CVE-2026-109619) means for each. One POSIX sh script; reads files only.

Published indicators and a log-hunting guide for the PHP2Shell PHP flaws (CVE-2026-109618, CVE-2026-109619)

CVE-2026-86076 — n8n expression sandbox escape via class-field __sanitize rebinding (backend RCE). Verified v2.37.6 (uid=node) / v2.37.7.

PHP Runtime Vulnerability Assessment Toolkit — CVE-2026-109618 & CVE-2026-109619

This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619. PHP is a widely used open-source server-side scripting language, so these vulnerabilities may affect a broad range of internet-facing web applications and products that embed or depend on PHP.

initial-access

Unofficial backports of the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619) to end-of-life PHP 7.0–7.3, with regression-tested patches and rebuilt packages for CentOS 7 (Remi), Debian 10 and Ubuntu 18.04 (Sury).

Check if your server is vulnerable for latest PHP2Shell (CVE-2026-109618,CVE-2026-109619, CVE-2026-115560)

initial-access

Gitea LFI to RCE exploit (CVE-2026-59774) — arbitrary file read via Org-mode #+INCLUDE, chained to remote code execution through git hook injection

CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)

Lab-only exact-profile RCE/DoS validator for CVE-2026-111497; refuses non-loopback targets

Entorno y explotación de la vulnerabilidad CVE-2025-5548 (buffer overflow en FreeFloat FTP Server 1.0)

Proyecto de explotación.

Non-invasive Python detector for CVE-2026-110264 in GitLab, featuring version checks, offline log analysis, and JSON reporting.

One-file PHP check for the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619). No exploit, no network.

CVE-2026-111497 – Node.js Brotli Decoder OOB Write (CVSS 9.2) | Red/Blue Team suite for unpatched Node.js 22.x, 24.x, 26.x. 2 tools: Full Exploit (patch detection, remote DoS, Brotli bomb, lab RCE), Blue Team Checker (errno differential, version fingerprint, WAF detection, reporting) Only Use Ethically Only <3

Production-ready backported .patch for EOL PHP 5.4,.23 custom 5.x to fix the critical PHP2Shell (OOM) vulnerability (CVE-2026-109618 / CVE-2026-109619).

MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.

PoC, Docker lab, and technical report for CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder invalid block-switch OOB write; validated errno differential and weaponized remote DoS, RCE analysis included.

Harmless fingerprint scanner for PHP CVE-2026-109618 / CVE-2026-109619 (CLI + Web UI)

initial-access

Desktop tool to find, audit, and remediate the PHP2Shell CVEs (CVE-2026-109618/109619) on your own infrastructure — network scan, SSH/SFTP checks, guided upgrades, and log analysis.

initial-access

Lab pembelajaran lokal untuk mereproduksi CVE-2026-109618/109619 pada Docker.

saaudsdk/php2shell-cve-2026-109618-109619-fix

PoC: CVE-2026-110152 Chrome ANGLE vertex-attribute translation heap buffer overflow (CVSS 9.6)

initial-access

denial-of-service

initial-access