Catálogo de exploits

PHP session.upload_progress UAF validation bundle (presumed CVE-2026-109618 / CVE-2026-109619) — authorized defensive-research use only

Mitigar CVE-2026-109618 e CVE-2026-109619: Software que permite bloquear requisições HTTP que utilizam multipart/form-data, normalmente empregado no envio de arquivos, em todos os sites hospedados ou somente em sites específicos.

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

One-line mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619): disables session.upload_progress across all PHP installs

ruby module for php2shell to scan for the vulns of CVE-2026-109618 & CVE-2026-109619

Emergency mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619) - Author: Revonnet EOOD

PHP2Shell Audit and Fix

Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell

Mitigation for CVE-2026-109618 and CVE-2026-109619 for PHP under 8.X

CVE-2026-109618/109619: PHP session.upload_progress Heap UAF — Detection & 8-chain RCE exploitation framework

scanner for CVE-2026-109618 / CVE-2026-109619

Experimental PHP 5.6.40 source backport for CVE-2026-109618 and CVE-2026-109619, with reproduction steps and test evidence. Not an official PHP release.

Independent verification lab + PoCs: PHP session.upload_progress pre-auth RCE chains (CVE-2026-109618/109619)

Script bash para validar que a iRule do F5 BIG-IP está bloqueando o padrão-gatilho php2shell (CVE-2026-109618 / CVE-2026-109619). Envia apenas o campo PHP_SESSION_UPLOAD_PROGRESS em multipart em variações (case, encoding, posição, chunked, query string) — NÃO é exploit, NÃO realiza RCE.

Mitigations for PHP installs that cannot update yet: CVE-2026-109618 / CVE-2026-109619 (php2shell) and CVE-2026-115560. Edge rules, auth before PHP, request limits, PHP settings. Unofficial. The real fix is updating PHP.

Detection checkers for CVE-2026-109618 / CVE-2026-109619 (PHP session upload progress RCE): version inventory, session-file and webroot hunts, known-good webroot diff

Unofficial PHP 7.4.33 RPMs for CentOS 7/EL7 with the PHP2Shell (CVE-2026-109618/109619) mitigation

php2shell (CVE-2026-109618/109619) checker that also finds vulnerable PHP inside Docker containers. Read-only, CI-friendly exit codes, field-tested patch guide.

Shell scripts that check Linux hosts for known vulnerabilities (PHP CVE-2026-109618/109619, Copy Fail CVE-2026-31431), report vulnerable, mitigated or fine, and apply the fix on request with --fix.

Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.

Paste a Dockerfile, docker-compose, php -v or a package list and see whether your PHP needs the October 2026 fix for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Reads text only.

PHP CVE-2026-109618/CVE-2026-109619 universal DoS attack toolkit

Check if your servers are affected by or compromised via php2shell (CVE-2026-109618 / CVE-2026-109619)

Repo with stuff wrt CVE-2026-109618 backports & workarounds..

php2shell (CVE-2026-109618, CVE-2026-109619) repo audit, CLI and GitHub Action, no server access. Lists the PHP versions it finds in Dockerfiles, compose, Kubernetes manifests, CI/setup-php and composer.json, in a repo or GitHub org, sorted by what needs the fix or a manual check. Recognizes Laravel Sail, WordPress and Drupal image tags.

Ansible Playbook that runs through your PHP-FPM and OpenLiteSpeed PHP files and applies a mitigation against CVE-2026-109619.

initial-access

zenzue/CVE-2026-109618_19

Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_progress, on by default since 5.4. Docker A/B (vulnerable vs patched builds), race harness, ASAN proof.

Cloudflare Worker: edge detection + blocking for PHP session.upload_progress RCE (CVE-2026-109618/109619) with Discord alerts — free tier, no KV