Catálogo de exploits

php2shell-CVE-2026-109618/109619 chain

Analisa e corrige as vulnerabilidades php2shell do PHP (CVE-2026-109618 e CVE-2026-109619) no Ubuntu

Sotrano-dev/cve-2026-112816

Defensive lab verification & IR note for php2shell (CVE-2026-109618 / CVE-2026-109619) — patch matrix, mitigation, hunt one-liners. No PoC.

GStreamer RTP Depayloader Memory Exhaustion Analysis

Authorized offensive-security lab using an agentic AI workflow to research, reproduce, and validate PHP2Shell (CVE-2026-109618 / CVE-2026-109619) PoCs against vulnerable and patched PHP runtimes.

Check whether a PHP version is patched against PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Stdlib-only Python.

Ansible playbook to mitigate CVE-2026-98432

Detection-only local triage scanner for Linux kernel Fragnesia CVE-2026-46300: grade a running or installed kernel against upstream and distro fixed builds. No payloads, no network.

Detector and local lab for CVE-2026-98432 (IPv4 TCP UAF in inet_opt/ireq_opt): static analysis, kprobes, the tcp2kaslr trigger vector, and remote-risk evidence. Not an exploit; no RCE.

eBPF (XDP/tc) mitigation for CVE-2026-98432 / RHSB-2026-016 - draft

PHP 8.1.34 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.

Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.

info-leak

⛩️☀️ Zero-cost Cloudflare Edge Defense (CVE-2026-109618) + HTTP x402 AI Crawler Monetization. Earn 20% USDC. Landauer Thermodynamics on Base L2.

antonyantony/cve-2026-98432-nft

Temporary mitigation for CVE-2026-98432 on AlmaLinux 8/9/10 and Ubuntu. Not a kernel fix.

Read-only patch-state and exposure check for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free, CVSS 9.8), with opt-in interim mitigation and exact rollback.

Interim nftables mitigation for CVE-2026-98432, automatic rollback and Russian administrator guide. Not a kernel patch.

davetha/cve-2026-98432

krevetkqqq/CVE-2014-9583

QT Analytics — Operation Fire Pole: Free 60-Second Emergency Defense & Reverse-Proxy Shield for PHP2Shell (CVE-2026-109618 / 109619)

Is the PHP in your container image really fixed for PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Finds PHP builds inside an image without running it, with backport-aware verdicts and evidence.

NTU SE6013 Software Security: Next.js CVE-2025-29927 group project. Maintainer-reviewed fork-and-PR contributions.

Open-source hotfix for PAN-OS firewall chain attack PHP2Shell and Fragnesia CVE-2026-109618 and CVE-2026-46300

Responsible exposure assessment and version fingerprinting for PHP core vulnerabilities CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) - detection-only, no RCE payload.

client-side

CVE-2026-109384: IvyForms <= 1.5.1 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).

Nucklear/CVE-2026-111497-working

Hunt-Benito/the-unguarded-first-day-cve-2026-103409-juniper-session-smart-router