Catálogo de exploits

Passive, non-intrusive measurement of how quickly U.S. state, county, city, and tribal government websites patch critical vulnerabilities, starting with PHP2Shell (CVE-2026-109618/109619). One GET request per domain per day. Research by Carroll University; opt-out on request.

Exploit tooling and vulnerability research for CVE-2026-109618 and CVE-2026-109619 — two critical unauthenticated remote code execution (RCE) vulnerabilities patched in PHP 8.4.27, 8.3.36, 8.2.35, and 8.5.12 (released October 21, 2026).

Status brief on the PHP2Shell RCE vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

Local probe for CVE-2026-111497 (Node.js Brotli decoder OOB write). Fixed in 22.23.4/24.22.1/26.12.1; EOL lines unpatched forever. Single file, zero deps.

Defensive PHP update guidance and local-only verification for CVE-2026-109618 and CVE-2026-109619.

cybersecurity/CVE-2026-93489

OpenSSL s_server testing tool for tiny EC private keys for CVE-2026-111943 research.

Passive scanner for PHP CVE-2026-109618 / CVE-2026-109619: subdomain discovery, PHP fingerprinting, local web UI

CVE-2026-110264 — GitLab Unauthenticated RCE (Onigmo regex repeat-ID overflow, CVSS 10.0). Docker-verified crash PoC on ruby 3.4.11 + measured heap analysis. Crash-level, non-weaponized.

Script para auditar las url en produccion si es vulnerable con el bug CVE-2026-109618 / CVE-2026-109619 — PHP

Compilación no oficial de PHP 7.4.33 para Windows x64 Thread Safe mediante GitHub Actions, con parches oficiales para CVE-2026-109618 y CVE-2026-109619. Orientada a Apache 2.4 y Wampserver 3.2.6 en Windows Server 2019.

cve explaination

Patched PHP 8.1 Windows binaries (x64/x86, NTS/TS) fixing critical RCE CVE-2026-109618 and CVE-2026-109619. PHP 8.1 is EOL and php.net ships no Windows build of the fix. Built from the official php-src backport with php-windows-builder; SHA-256 checksums and signed build provenance.

Wordpress Plugin that checks if your PHP Version is patched against CVE-2026-109618 / CVE-2026-109619

Patched PHP 7.4 RPMs for CentOS 7 (Remi php-* and php74-php-*) fixing CVE-2026-109618 / CVE-2026-109619: Remi's 7.4.33-31 rebuilt for EL7, with an installer that detects the server's PHP, upgrades it and can roll back.

Exposure scanner for CVE-2026-109618 / CVE-2026-109619 session and upload_progress attack chains on legacy PHP. Single-file, zero-dep Python: remote probes, domain crawl, local audit, XLSX reports. Non-destructive. Authorized use only. Non-commercial license.

Marciano-Morinigo/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-Lab

A temporary shield for **UISP servers running the CRM**, against the **PHP2Shell** vulnerabilities (CVE-2026-109618 and CVE-2026-109619, published 21 October 2026), until Ubiquiti ships a UISP update with a patched PHP.

Portable Agent Skill to verify PHP patch status for the Oct 2026 RCE pair (CVE-2026-109618/619) and audit the CERT-EU mitigations. Verifies, does not exploit.

A lightweight Python CLI to assess PHP2Shell (CVE-2026-109618 & CVE-2026-109619) exposure via version checks.

Unofficial CVE-2026-109618 / CVE-2026-109619 source backport for Ubuntu 14.04 PHP 5.5.9, with build verification and regression evidence.

a defensive security CLI that detects, assesses, and recommends remediation for CVE-2026-109618 and CVE-2026-109619

List PHP processes and versions on Dynatrace Managed, flagging CVE-2026-109618/109619

This report delivers an exhaustive technical breakdown and operational risk assessment regarding "PHP2Shell", a devastating pair of core remote code execution (RCE) vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry a critical CVSS v4.0 severity rating of 9.2/10.

absholi7ly/Deep-Technical-Report-CVE-2026-109618-CVE-2026-109619-PHP2Shell

🛡️ CVE-2026-109618 / CVE-2026-109619 PHP Exploit Scanner | *A unified scanner and exploitation tool for critical PHP vulnerabilities*

Node.js app using adm-zip (CVE-2026-114102 DoS)

Chequeo no invasivo de php2shell (CVE-2026-109618 / CVE-2026-109619): fingerprint de PHP, inferencia de SAPI y veredicto de parche. Python puro, sin dependencias.

Free Bash script to check servers, SSH hosts and Docker containers for the PHP2Shell RCE flaws (CVE-2026-109618 & CVE-2026-109619). Read-only. Flags PATCHED, VULNERABLE or unsupported PHP versions.

php2shell-enterprise-hardening (CVE-2026-109618 / CVE-2026-109619) - Hyperscale Defense-in-Depth, Non-Breaking Mitigations & Instant Immunity Auditor for PHP Pre-Auth RCE.