Catálogo de exploits

zenzue/CVE-2026-109618_19

Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_progress, on by default since 5.4. Docker A/B (vulnerable vs patched builds), race harness, ASAN proof.

A working PoC of the PHP2Shell exploit

Local exposure auditor for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF). Answers whether YOUR host is exposed, with proof.

Isolated Docker lab to verify CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress cross-request UAF -> RCE)

junaire/CVE-2026-109618-exploit

Script bash para validar que a iRule do F5 BIG-IP está bloqueando o padrão-gatilho php2shell (CVE-2026-109618 / CVE-2026-109619). Envia apenas o campo PHP_SESSION_UPLOAD_PROGRESS em multipart em variações (case, encoding, posição, chunked, query string) — NÃO é exploit, NÃO realiza RCE.

Defensive Detector + Bounded Offensive Impact-Evidence Builder for CVE-2026-109618 / CVE-2026-109619 ("PHP2Shell")

Escáner defensivo por versión para detectar servidores PHP afectados por PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Comprueba la versión de PHP vía HTTP y la compara con las versiones corregidas. Solo detección, sin exploits.

Reproducer for CVE-2026-88900 — Apache Camel camel-jgroups unsafe Java deserialization of cluster messages (CWE-502, HIGH). Camel Spring Boot.

Reproducer for CVE-2026-91858 — Apache Camel camel-fop XML External Entity (XXE) via a third-party TransformerFactory (CWE-611). Camel Spring Boot + Camel Quarkus.

Reproducer for CVE-2026-85317 — Apache Camel camel-http OAuth2 token cache confusion (CWE-524). Camel Spring Boot.

scanner for CVE-2026-109618 / CVE-2026-109619

daffa001/php-CVE-2026-109618-CVE-2026-109619

Mitigation for CVE-2026-109618 and CVE-2026-109619 for PHP under 8.X

CVE-2026-109618

php2shellscanner

Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.

Runtime probe for MCP cross-tenant response leaking via JSON-RPC id collision (CVE-2026-111770)

Ansible Playbook that runs through your PHP-FPM and OpenLiteSpeed PHP files and applies a mitigation against CVE-2026-109619.

Mitigar CVE-2026-109618 e CVE-2026-109619: Software que permite bloquear requisições HTTP que utilizam multipart/form-data, normalmente empregado no envio de arquivos, em todos os sites hospedados ou somente em sites específicos.

scan and fix php version affected by CVE-2026-109618 and CVE-2026-109619

Pre-auth remote code execution & reverse shell PoC for CVE-2026-109618 / CVE-2026-109619 - PHP core session upload-progress. One URL in, a reverse shell out.

Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets

initial-access

Crónica y PoC del patch-day de PHP (21-oct-2026): CVE-2026-109618 / CVE-2026-109619 — RCE pre-auth en mod_php. Primitiva reproducida en stock 8.5.11 y en Nextcloud real. Lab-only.

PHP 8.2-8.5 Docker images (cli/fpm/apache) patched for CVE-2026-109618 / CVE-2026-109619 (php2shell), multi-arch, on GHCR

PhpReaper — GUI vulnerability scanner for CVE-2026-109618 / CVE-2026-109619 (PHP session upload progress RCE)

Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CVE-2026-109618 / CVE-2026-109619, CVSS 9.2, fixed 2026-10-21). Includes a heap layout study, a reproduction lab, an exposure scanner and a one-line remediation guide.

initial-access