Catálogo de exploits

Check, block and hunt for php2shell (CVE-2026-109618 / CVE-2026-109619): PHP version scan with distro backport check, tested Apache/Nginx/Caddy/HAProxy/ModSecurity rules, compromise triage.

Cron watchdog for PHP-FPM servers: crashed workers, spawned shells, odd connections, new files, persistence. Written for php2shell (CVE-2026-109618/109619).

针对 CVE-2026-111943（eMudhra / emSign 根证书密钥熵坍塌惨案）的突发供应链应急排查与修复工具：一键清洗 Kali、Python、Node.js、uv、Go、Java 与 Docker 中的致命弱私钥信任链。Emergency audit & remediation toolkit for CVE-2026-111943 (eMudhra / emSign CA Private Key Entropy Collapse). Purges weak intermediate/root CAs across Kali, Python, Node.js, Rust uv, Go, Java, and Docker toolchains.

php2shell (CVE-2026-109618/109619) checker that also finds vulnerable PHP inside Docker containers. Read-only, CI-friendly exit codes, field-tested patch guide.

Unofficial PHP 7.4.33 RPMs for CentOS 7/EL7 with the PHP2Shell (CVE-2026-109618/109619) mitigation

Mitigação temporária para o php2shell (CVE-2026-109618 / CVE-2026-109619): como desabilitar session.upload_progress no PHP em Linux, cPanel, CloudLinux e Plesk, com validação via HTTP. Paliativo até o patch oficial, não substitui a atualização.

Initial version of custom CrowdSec rule for CVE-2026-109618 and CVE-2026-109619

Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.

Shell scripts that check Linux hosts for known vulnerabilities (PHP CVE-2026-109618/109619, Copy Fail CVE-2026-31431), report vulnerable, mitigated or fine, and apply the fix on request with --fix.

Blue-team detection signatures and interim mitigations for php2shell (CVE-2026-109618/109619) PHP pre-auth RCE pair. Detection and hardening only.

php2shellscanner

Example lab for CVE-2026-109618 / CVE-2026-109619 (php2shell): unpatched PHP session.upload_progress site + Python client.

php2shellscanner

The vulneurability causes RCE ending

Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CVE-2026-109618 / CVE-2026-109619, CVSS 9.2, fixed 2026-10-21). Includes a heap layout study, a reproduction lab, an exposure scanner and a one-line remediation guide.

🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 — session.upload_progress 文件名注入 + LFI → RCE，Docker 一键启动，附中文原理分析与 PoC

this is a exploit for CVE-2026-109619

Mitigar CVE-2026-109618 e CVE-2026-109619: Software que permite bloquear requisições HTTP que utilizam multipart/form-data, normalmente empregado no envio de arquivos, em todos os sites hospedados ou somente em sites específicos.

Tracking PHP CVE-2026-109618 / CVE-2026-109619: official status, patches, mitigations

Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.

PoC CVE-2026-109618 / -109619 (PHP session.upload_progress heap UAF)

PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 )

CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress RCE PoC & Vulnerable Lab

cozybear-dev/cve-2026-109619

Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CVE-2026-109618 / CVE-2026-109619, CVSS 9.2, fixed 2026-10-21). Includes a heap layout study, a reproduction lab, an exposure scanner and a one-line remediation guide.

initial-access

local

CVE-2026-109618

local

Non-destructive detection toolkit + version-differential oracle for PHP2Shell (CVE-2026-109618/109619). Leak oracle verified 4/4 on PHP 8.5.11 vs 0/4 on 8.5.12. Docker lab included.