Catálogo de exploits

Information about CVE-2026-109618 and CVE-2026-109619

Scanner, interim mitigation and hunting tool for php2shell (CVE-2026-109618 / CVE-2026-109619). No exploit code.

UNTESTED unofficial PHP images (EOL versions) with php2shell (CVE-2026-109618/109619) mitigation backports - one tag per version/SAPI

Corrección de PHP2Shell (CVE-2026-109618 / CVE-2026-109619) para PHP 7.4 en CentOS/RHEL/CloudLinux con cPanel, Plesk o DirectAdmin. Aplica el commit oficial de PHP 712e60f9.

Non-destructive exploitability checker for PHP2Shell (CVE-2026-109618/109619) — probes whether the session.upload_progress use-after-free preconditions are present without dropping shells

Check after php

Exploit tooling and vulnerability research for CVE-2026-109618 and CVE-2026-109619 — two critical unauthenticated remote code execution (RCE) vulnerabilities patched in PHP 8.4.27, 8.3.36, 8.2.35, and 8.5.12 (released October 21, 2026).

Read-only triage script for the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).

Passive, non-intrusive measurement of how quickly U.S. state, county, city, and tribal government websites patch critical vulnerabilities, starting with PHP2Shell (CVE-2026-109618/109619). One GET request per domain per day. Research by Carroll University; opt-out on request.

php-backport:7.4-apache PHP-7.4-CVE-2026-109618-109619

Fixed PHP versions and distro packages for PHP2Shell (CVE-2026-109618, CVE-2026-109619) as JSON. CC0. Data behind php2shell.fyi.

Complete auto exploit for NGINX PHP-FPM CVE-2026-109618 / CVE-2026-109619

一个快速、批量检测PHP版本是否存在CVE-2026-109618/109619

Free open-source scanner: is your PHP version vulnerable to php2shell (CVE-2026-109618 / CVE-2026-109619)? Disclosure-only — no exploit probes.

PoC for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) zero-depndency, pre-auth RCE via a use-after-free in PHP's session.upload_progress handler. Affects PHP 5.48.5.11 fixed in 8.2.35+

Is your site exposed to php2shell (CVE-2026-109618, CVE-2026-109619), the October 2026 PHP remote code execution flaws? A one-file, zero-dependency CLI and GitHub Action that reads what your site shows anyone, with evidence and a curl command for every finding. Also checks the Node.js October 2026 releases.

Security audit notes for CVE-2025-29927 (Next.js middleware authorization bypass) - upgrade plan for architecture review

CVE-2026-109618, CVE-2026-109619

Portable Agent Skill to verify PHP patch status for the Oct 2026 RCE pair (CVE-2026-109618/619) and audit the CERT-EU mitigations. Verifies, does not exploit.

CVE-2026-110264: GitLab pre-auth RCE via Onigmo integer overflow in org-ruby. Docker-based validation, admin check script, attack surface analysis.

Environment checker (for CVE-2026-109618 and CVE-2026-109619)

Security Ways for AI coding agents. First member audits Node.js repos for the Oct 21, 2026 security release (CVE-2026-111497 Brotli RCE) and opens a patch PR only if affected.

CVE-2026-111497: Node.js Brotli decoder OOB write — analysis, PoC, Docker lab

Fast, concurrent, non-intrusive exposure auditor in Go for the GitLab CE/EE unauthenticated RCE (CVE-2026-110264, CVSS 10.0). For defensive use.

CVE-2026-106173 – FortiSIEM phQueryMaster RCE (CVSS 9.8) | Red/Blue Team suite for unpatched FortiSIEM 7.5.0. 2 tools: Full Exploit (multi-primitive RCE, reverse shell, persistence, creds, readback, mass scan, Tor), Blue Team Checker (exposure detection, HTTP/2 fingerprint, reporting, audit). Only Use Ethically, Stay Legal <3

PoC and verification material for CVE-2026-96652 (Plex Media Server timeline SSRF, owner-token disclosure chain)

PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 6 RCE chains, memory disclosure, scanner, detection rules, WAF mitigations, Docker labs. Authorized testing only.

PHP2Shell — PHP session upload-progress RCE & memory disclosure research (CVE-2026-109618 / CVE-2026-109619): exploits, Docker lab, scanner and tooling. Authorized testing only.

BIBILZERODAY/CVE-2026-102785---YooTheme-Mass-Exploit-Webshell.Store-

Localhost-only Docker lab reproducing PHP 2026-10 memory-safety CVEs (CVE-2026-109618/-109619) via official regression tests. Differential vulnerable-vs-fixed, no exploit code.