Catálogo de exploits

cve-2026-109618-109619-poc

CVE-2026-111497 — Node.js Brotli Decoder OOB Write: Deep Analysis & Structural Unreachability Proof. MLEN_MAX = BLOCK_SIZE_CAP = 2^24 makes RCE structurally unreachable.

Detection for the critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619. Reports vulnerable/patched/EOL PHP runtimes by version and config.

Guide, self-assessment form and read-only Linux check script for php2shell (CVE-2026-109618 / CVE-2026-109619): find out if you're exposed, patch, and check whether you were compromised.

Read-only PHP2Shell audit for CVE-2026-109618 and CVE-2026-109619. Discover PHP services and prepare remediation. Linux Bash + Windows PowerShell; EN/PT HTML and CSV reports.

One command to find and fix PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on any Linux server or Mac. Patches every PHP install in place, keeping your current PHP version (distro, Sury or Remi builds), with an opt-in --force upgrade and rollback.

PHP 5.6 security patch, backports, and mitigations for session.upload_progress Use-After-Free (CVE-2026-109618, CVE-2026-109619).

Two small, read-only tools to confirm whether your PHP installations are patched against the critical RCE advisory published 2026-10-21 (CVE-2026-109618 / CVE-2026-109619)

baron-stybd/CVE-2026-109618-CVE-2026-109619

CVE-2026-106173 – FortiSIEM phQueryMaster RCE (CVSS 9.8) | Red/Blue Team suite for unpatched FortiSIEM 7.5.0. 2 tools: Full Exploit (multi-primitive RCE, reverse shell, persistence, creds, readback, mass scan, Tor), Blue Team Checker (exposure detection, HTTP/2 fingerprint, reporting, audit). Only Use Ethically, Stay Legal <3

Unofficial fix for CVE-2026-109618 / CVE-2026-109619 (php2shell) for the end-of-life PHP 5.4 / 5.3 packages of RHEL, CentOS and Oracle Linux 7 / 6

🛡️ ACYBER Security Toolkit — Automated detection & patching of CVE-2026-109618 (php2shell RCE) across Ubuntu, Debian, RHEL, CentOS, Rocky & AlmaLinux.

Signed, tested backports of EOL PHP (7.4/8.0/8.1) for CVE-2026-109618 & CVE-2026-109619 (php2shell)

CVE-2026-109618 / CVE-2026-109619 PHP OOM Corruption PoC

Defensive self-check & response toolkit for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Version x SAPI risk check, emergency report, WAF templates. No exploit code.

PHP2Shell — PHP session upload-progress RCE & memory disclosure research (CVE-2026-109618 / CVE-2026-109619): exploits, Docker lab, scanner and tooling. Authorized testing only.

Guide opérationnel, outils d’audit et procédure de remédiation pour CVE-2026-109618 et CVE-2026-109619.

Free scanner for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Exploit tooling and vulnerability research for CVE-2026-109618 and CVE-2026-109619 — two critical unauthenticated remote code execution (RCE) vulnerabilities patched in PHP 8.4.27, 8.3.36, 8.2.35, and 8.5.12 (released October 21, 2026).

CVE-2026-109618 php2shell local lab PoC

phpwshell poc for CVE-2026-109618

Unofficial backport of the official php2shell fix (CVE-2026-109618 / CVE-2026-109619) to PHP 7.3.33. Original fix by Arnaud Le Blanc & Ilija Tovilo (php/php-src).

PoC per php2shell CVE-2026-109618/109619 (Chain D OOM + variante senza upload) — coding by GLM uncensored

Отчёт: переход хостинга с PHP 5.6/7.4 на PHP 8.4 после CVE-2026-109618/109619

Bluefire Redteam detection, interim hardening, and edge filter for PHP2Shell (CVE-2026-109618, CVE-2026-109619).

Image PHP 8.3.36 (corrigee CVE-2026-109618/109619) + Apache pour PrestaShop 9 - malac.shop

Virtual patch / WAF rules for PHP2Shell (CVE-2026-109618, CVE-2026-109619)

Static, no-tracking check of a declared PHP setup against two critical advisories (CVE-2026-109618, CVE-2026-109619).

Userscript that warns when a site runs a PHP version affected by php2shell (CVE-2026-109618/109619)

CVE-2026-109618, CVE-2026-109619