Catálogo de exploits

syrex1013/CVE-2026-109619

Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell

Independent PHP2Shell research: CVE-2026-109618/109619 status, source-linked PoC audits, and evidence tracker.

Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CVE-2026-109618 / CVE-2026-109619, CVSS 9.2, fixed 2026-10-21). Includes a heap layout study, a reproduction lab, an exposure scanner and a one-line remediation guide.

Important: PHP 5.6 is an end-of-life release. This patch should only be considered a security measure after its source changes have been reviewed and tested against the original PHP 5.6.40 codebase. Successful application and verification are required before claiming that either vulnerability is fixed.

Safe, reversible interim hardening for critical PHP vulnerabilities while you wait for patched builds. One opt-in module per advisory, dry run by default, auto rollback, one-command revert. Current: CVE-2026-109618 / CVE-2026-109619 (Oct 2026). Not a fix: update PHP.

Lab, PoC, ASan research and EOL backport for CVE-2026-109618/109619 (PHP OOM state corruption). Defensive research.

PHP 8.2-8.5 Docker images (cli/fpm/apache) patched for CVE-2026-109618 / CVE-2026-109619 (php2shell), multi-arch, on GHCR

Mitigations Windows et Linux pour PHP2Shell (CVE-2026-109618 et CVE-2026-109619)

针对 CVE-2026-111943（eMudhra / emSign 根证书密钥熵坍塌惨案）的突发供应链应急排查与修复工具：一键清洗 Kali、Python、Node.js、uv、Go、Java 与 Docker 中的致命弱私钥信任链。Emergency audit & remediation toolkit for CVE-2026-111943 (eMudhra / emSign CA Private Key Entropy Collapse). Purges weak intermediate/root CAs across Kali, Python, Node.js, Rust uv, Go, Java, and Docker toolchains.

Non-destructive scanner for CVE-2026-109618 and CVE-2026-109619

php2shell response kit. (CVE-2026-109618 / CVE-2026-109619)

junaire/CVE-2026-109618-exploit

Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no dependencies, no exploit payloads.

PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 )

Dokploy <=0.29.12 compose branch stored command injection (CVSS 9.9 Critical) — clean-room exploit, swarm lab orchestration, reproduced live against v0.29.12 with host-takeover channel proof

daffa001/php-CVE-2026-109618-CVE-2026-109619

initial-access

Script bash para validar que a iRule do F5 BIG-IP está bloqueando o padrão-gatilho php2shell (CVE-2026-109618 / CVE-2026-109619). Envia apenas o campo PHP_SESSION_UPLOAD_PROGRESS em multipart em variações (case, encoding, posição, chunked, query string) — NÃO é exploit, NÃO realiza RCE.

PoC for Gitea versions before 1.27.1 is vulnerable to Path Traversal (CWE-22), which leads to unauthenticated arbitrary file read / information disclosure leading to RCE CVSS 9.8

Docker linux/amd64 build for WordPress 7.1.3 on PHP 8.5.12 FPM Alpine, with fixes for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Temporary PHP2Shell mitigation for DirectAdmin PHP-FPM servers (CVE-2026-109618, CVE-2026-109619) using Ansible. Includes deployment, verification and rollback.

Check and apply the php2shell fix (CVE-2026-109618, CVE-2026-109619) on hosts, SSH servers and Docker images

Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_progress, on by default since 5.4. Docker A/B (vulnerable vs patched builds), race harness, ASAN proof.

Experimental PHP 5.6.40 source backport for CVE-2026-109618 and CVE-2026-109619, with reproduction steps and test evidence. Not an official PHP release.

PHP2Shell (CVE-2026-109618, CVE-2026-109619): 100% reliable DoS PoC for Apache mod_php, with Docker lab and pcap

Unofficial PHP 8.1.34 builds for Linux and Windows with the PHP security team’s PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619), plus build scripts and regression tests.

PHP 7.4.33 FPM image with the official CVE-2026-109618 / CVE-2026-109619 emergency backport

CVE-2026-109618

zenzue/CVE-2026-109618_19