Catálogo de exploits

Independent PHP2Shell research: CVE-2026-109618/109619 status, source-linked PoC audits, and evidence tracker.

Non-destructive affected-version checker for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) PHP OOM/longjmp UAF

Non destructive scanner for PHP instances vulnerable to CVE-2026-109618 and CVE-2026-109619

The PoC of CVE-2026-109618 and CVE-2026-109619

info-leak

php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discovery, SAPI profiling, OOM fuzzing calibration, and FPM worker pinning. Stdlib only.

Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619

PHP2Shell Evaluación de CVE-2026-109618 and CVE-2026-109619

DAS-Bodhi/CVE-2026-110936-Siemens-Attack

PHP extension that makes the php2shell session upload-progress handler (CVE-2026-109618 / CVE-2026-109619) unreachable, for every PHP from 5.3 to 8.5.

AvaterXXX/CVE-2026-109618-CVE-2026-109619-

Material e script de diagnóstico (somente leitura) para as CVE-2026-109618 e CVE-2026-109619 (php2shell)

Relatório de hardening e laboratório Docker defensivo para a PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Sem PoC ofensivo.

Debian/Apache mod_php + Sury PHP 7.4 with php2shell EOL mitigation (CVE-2026-109618 / 109619). Bridge for legacy apps. Prefer 8.2.35+.

local

CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)

PHP 7.4 for Windows with CVE-2026-109618 / CVE-2026-109619 Backport

local

initial-access

php:7.4-fpm drop-in rebuilt with the CVE-2026-109618/109619 fix (PHP2Shell)

php2shell (CVE-2026-109618, CVE-2026-109619) repo audit, CLI and GitHub Action, no server access. Lists the PHP versions it finds in Dockerfiles, compose, Kubernetes manifests, CI/setup-php and composer.json, in a repo or GitHub org, sorted by what needs the fix or a manual check. Recognizes Laravel Sail, WordPress and Drupal image tags.

Working local PoC for the php2shell PHP RCE pair (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution via session.upload_progress multipart OOM in Apache mod_php. Docker A/B lab (8.4.26 vs 8.4.27), exploit patch for emulated x86-64, and patch-verification methodology.

Divineokoduwa/CVE-2020-1472-Zerologon-Vulnerability-Assessment

Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.

initial-access

CVE-2026-102764 — BeyondTrust Remote Support Exploit

initial-access

cve-2018-16763-exploit

local

Incident-response tabletop exercise artifacts for the Log4Shell (CVE-2021-44228) drill