Catálogo de exploits

php2shell response kit. (CVE-2026-109618 / CVE-2026-109619)

PHP extension that makes the php2shell session upload-progress handler (CVE-2026-109618 / CVE-2026-109619) unreachable, for every PHP from 5.3 to 8.5.

this is a exploit for CVE-2026-109619

Cron watchdog for PHP-FPM servers: crashed workers, spawned shells, odd connections, new files, persistence. Written for php2shell (CVE-2026-109618/109619).

CVE-2026-109618

Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.6-8.5; Sury, cPanel EA4, DirectAdmin, Docker, Windows.

Cloudflare Worker: edge detection + blocking for PHP session.upload_progress RCE (CVE-2026-109618/109619) with Discord alerts — free tier, no KV

cozybear-dev/cve-2026-109619

Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.

Emergency mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619) - Author: Revonnet EOOD

php2shellscanner

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CVE-2026-109618 / CVE-2026-109619, CVSS 9.2, fixed 2026-10-21). Includes a heap layout study, a reproduction lab, an exposure scanner and a one-line remediation guide.

CVE-2026-97629 — nginx TLS session-ticket forgery that can bypass client-certificate (mTLS) authentication. Root cause, one-line patch, proof-of-concept exploit and reproduction evidence. Found and disclosed by PhiNode Labs; credited by F5. Fixed in nginx 1.31.7 / 1.30.6.

Pre-auth remote code execution & reverse shell PoC for CVE-2026-109618 / CVE-2026-109619 - PHP core session upload-progress. One URL in, a reverse shell out.

Detection, mitigation, patching and fleet automation for the PHP2Shell RCE pair (CVE-2026-109618 / CVE-2026-109619)

PHP2Shell (CVE-2026-109618/109619) exposure check: find which of your accounts sit on sites running PHP, rank the risk, and know what to delete first. Passive only.

PhpReaper — GUI vulnerability scanner for CVE-2026-109618 / CVE-2026-109619 (PHP session upload progress RCE)

Independent verification of CVE-2026-109618 & CVE-2026-109619 (php2shell): kernel-proven session-lock-leak DoS on PHP 8.4.24, clean on patched 8.4.27, vendor OOM test suite 5-fail vs 0-fail. Lab, PoC scripts and full results - no weaponized exploit :)

Ansible Playbook that runs through your PHP-FPM and OpenLiteSpeed PHP files and applies a mitigation against CVE-2026-109619.

Non-destructive PHP scanner for CVE-2026-109618 and CVE-2026-109619

Minimal PHP session upload progress use-after-free PoC and Docker lab.

Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no dependencies, no exploit payloads.

Checks Linux and Windows servers for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell) and offers fixes, asking before each change

Mitigação temporária para o php2shell (CVE-2026-109618 / CVE-2026-109619): como desabilitar session.upload_progress no PHP em Linux, cPanel, CloudLinux e Plesk, com validação via HTTP. Paliativo até o patch oficial, não substitui a atualização.

Dokploy <=0.29.12 compose branch stored command injection (CVSS 9.9 Critical) — clean-room exploit, swarm lab orchestration, reproduced live against v0.29.12 with host-takeover channel proof

php2shell | CVE-2026-109618 & CVE-2026-109619

Experimental PHP 5.6.40 source backport for CVE-2026-109618 and CVE-2026-109619, with reproduction steps and test evidence. Not an official PHP release.

Initial version of custom CrowdSec rule for CVE-2026-109618 and CVE-2026-109619

Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell