FencerEngage / courier-dota2

Published: 2026-10-31

ikow / php2shell-poc

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

devploit / php2shell

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

Mortaliewrath / manta-dota2

Published: 2026-10-31

StapleParakeet / rune-dota2

Published: 2026-10-31

trapghostwall / ancient-dota2

Published: 2026-11-01

magentaechoenchant / glyph-dota2

Published: 2026-10-31

Lookouteiseparator / droids-v1.5.2

Published: 2026-10-28

BranchLegendWhirl71 / hexa-v2.6.0

Published: 2026-10-28

ExitGooseEntrance / relay-v2.2.0

Published: 2026-10-28

UltraSultanHonor / recon-v1.7.0

Published: 2026-10-28

Centaurbinexplode / nova-v1.9.2

Published: 2026-10-28

Novavyalimit / vanta-v2.1.0

Published: 2026-10-28

J-Vinicius / nova-ui

Published: 2026-10-31

nguyenthetri2k1 / aether-hub

Published: 2026-10-31

lokyfordev / pulse-toolkit

Published: 2026-10-31

assetnote / php2shell-scanner

High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)

NCSC-NL / php2shell

Operational information regarding the 2026 php2shell vulnerabilities

Mas0nShi / CVE-2026-112445

CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date

eness / php2shell-CVE-2026-109618-CVE-2026-109619-PoC

Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.

aarsaputra / php2shell

Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design

MchinaMd57764 / AVETemporalPoC-CVE-2026-112705

PoC & panic evidence for CVE-2026-112705: AppleAVE2 kernel OOB write on iOS 27.0.1 (fixed in 27.2) via VideoToolbox NumberOfTemporalLayers. Independent reproduction; original discovery by Calif / Chollima team.

assetnote / node2shell-scanner

High fidelity detection mechanism for node2shell (CVE-2026-111497)

dimasma0305 / CVE-2026-111497-POC

Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness

caveeroo / cve-2026-111497-wordpress-poc

CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress

jha0313 / second-brain-eval-kit

세컨브레인(codebase-brain)과 스킬 Eval(skill-eval) 프로토타입 — 패스트캠퍼스 세미나 2026-10-31

HOSTED-POWER / php_uploadprogress_guard

Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.6-8.5; Sury, cPanel EA4, DirectAdmin, Docker, Windows.

syrex1013 / CVE-2026-111497-node2shell

CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)

murrez / php2shell

php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discovery, SAPI profiling, OOM fuzzing calibration, and FPM worker pinning. Stdlib only.

trailofbits / brotli-checker

Claude Code and Codex skill for finding potentially vulnerable Brotli copies and guiding updates for CVE-2026-111497.

JoasASantos / php2shell-exploit

PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE

Anton-Barinov / php2shell-patches

php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.

mpyw / php-eol-CVE-2026-109618-109619

PHP 7.4 / 8.0 / 8.1 Docker images with the CVE-2026-109618 / CVE-2026-109619 fix backported

syrex1013 / php2shell

CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)

aancw / php2shell-scanner

Scanner for PHP2Shell (CVE-2026-109618/109619): URL blackbox, local device and SSH.

horizon3ai / CVE-2026-106173

Proof of concept exploit for CVE-2026-106173, a path traversal file write leading to RCE for Fortinet FortiSIEM

Is4yev / php2shell-poc

CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework)

vperetti / php-cve-2026-109618-109619-backports

Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3

pentestershell / php2shellbt

Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.

godylockz / CVE-2026-109618-109619

Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell

kuwoo / php2shell-Lab

🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 — session.upload_progress 文件名注入 + LFI → RCE，Docker 一键启动，附中文原理分析与 PoC

Hexeption / MCP-Reborn

MCP-Reborn is an MCP (Mod Coder Pack) for Minecraft for making modded clients and researching its code. (1.13-26.3)

junaire / CVE-2026-109618-exploit

—

syhunt / php2shell-protection

Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), including Apache protections and PHP hardening guidance

JoasASantos / php2shell-scanner

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

xuehuolll / php2shell-CVE-2026-109618-109619

CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.

david-alvarez-rosa / php-rce

Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets

PerryLink / dsh-memento

Bounded, layered, approval-gated, auditable cross-session memory for DeepSeek Harness: a ctx.memory capability seam with a zero-dependency SQLite provider, a memory tool, and frozen snapshot injection. Active (unfrozen 2026-10-12); see README for alternatives.

dinosn / php-cve-2026-10961x-lab-poc

PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12

Qsnh / php2shell-fixed

宝塔面板（BT Panel）上已停止维护的 PHP 版本（5.4 – 8.1）的 PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修复包。仓库里有打好补丁的源码包，以及一键完成编译、替换、回滚的脚本。

Niek / php7

PHP 7.4 security-backport packages for older Ubuntu and Debian releases

enactive-systems / CVE-2026-109618-poc

—

everyinfra / jev-radar

📡 The most rigorously verified tracker of the Jev (TypeSafe AI System One) ecosystem — 1486 confidence-graded entries (A725·B761) · last scan 2026-11-02 · bilingual EN/中文 · API access guide

mikensec / php2shell-lab

Offline, reproducible lab to safely analyse an untrusted PoC for CVE-2026-109618/109619 and build detection rules. No exploit included; bring your own sample.

PerryLink / dsh-claude-move

Four-source migration wizard for DeepSeek Harness: move Claude Code, Codex, OpenCode and Hermes sessions, memories, skills, instructions and slash commands into DSH, through a /move wizard with resumable, approval-gated, idempotent sessions. Maintenance status: FROZEN since 2026-10-05.

ynsmroztas / KeySniper

**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.

Snizi / CVE-2026-18963-Exploit

Exploit for KeyCloak CVE-2026-18963

gryphonrollershift / table-pull

Published: 2026-10-19

EnamelTempoSlip / llm-arena

Published: 2026-10-18

Photonkutrolley / sfxpad

Published: 2026-10-18