ikow / php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
ikow / php2shell-poc
eness / php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
assetnote / php2shell-scanner
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
JoasASantos / php2shell-exploit
PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
devploit / php2shell
PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance for authorized security testing.
HOSTED-POWER / php_uploadprogress_guard
Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.6-8.5; Sury, cPanel EA4, DirectAdmin, Docker, Windows.
junaire / CVE-2026-109618-exploit
—
syrex1013 / php2shell
CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)
dinosn / php-cve-2026-10961x-lab-poc
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
JoasASantos / php2shell-scanner
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
syhunt / php2shell-protection
Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), including Apache protections and PHP hardening guidance
Anton-Barinov / php2shell-patches
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.
pentestershell / php2shellbt
Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.
murrez / php2shell
php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discovery, SAPI profiling, OOM fuzzing calibration, and FPM worker pinning. Stdlib only.
Qsnh / php2shell-fixed
宝塔面板（BT Panel）上已停止维护的 PHP 版本（5.4 – 8.1）的 PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修复包。仓库里有打好补丁的源码包，以及一键完成编译、替换、回滚的脚本。
mpyw / php-eol-CVE-2026-109618-109619
PHP 7.4 / 8.0 / 8.1 Docker images with the CVE-2026-109618 / CVE-2026-109619 fix backported
Is4yev / php2shell-poc
CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework)
vperetti / php-cve-2026-109618-109619-backports
Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3
aancw / php2shell-scanner
Scanner for PHP2Shell (CVE-2026-109618/109619): URL blackbox, local device and SSH.
enactive-systems / CVE-2026-109618-poc
—
xuehuolll / php2shell-CVE-2026-109618-109619
CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.
Niek / php7
PHP 7.4 security-backport packages for older Ubuntu and Debian releases
david-alvarez-rosa / php-rce
Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets
godylockz / cve-2026-109618-php2shell
Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell
mikensec / php2shell-lab
Offline, reproducible lab to safely analyse an untrusted PoC for CVE-2026-109618/109619 and build detection rules. No exploit included; bring your own sample.
kuwoo / php2shell-Lab
🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 — session.upload_progress 文件名注入 + LFI → RCE，Docker 一键启动，附中文原理分析与 PoC
0x4148 / CVE-2026-109618-php2shell-lab
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Docker lab and PoC. Use-After-Free in PHP's session.upload_progress.