ikow / php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
ikow / php2shell-poc
9bie / php2shell-bypass-aslr-exp
A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.
eness / php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
openai / php2shell-checker
—
assetnote / php2shell-scanner
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
NCSC-NL / php2shell
Operational information regarding the 2026 php2shell vulnerabilities
HOSTED-POWER / php_uploadprogress_guard
Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.6-8.5; Sury, cPanel EA4, DirectAdmin, Docker, Windows.
syrex1013 / php2shell
CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)
devploit / php2shell
PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance for authorized security testing.
JoasASantos / php2shell-scanner
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
dinosn / php-cve-2026-10961x-lab-poc
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
syhunt / php2shell-protection
Emergency Apache mitigation and testing toolkit for php2shell (CVE-2026-109618 / CVE-2026-109619), featuring multipart POST blocking, request-size limits, and additional hardening measures.
Anton-Barinov / php2shell-patches
php2shell (CVE-2026-109618/CVE-2026-109619) emergency patches for old PHP 5.6/7.x/8.0/8.1 — official + community backports, enhanced universal patch keeping file uploads & progress bars. For OpenCart, WordPress, HestiaCP/VestaCP legacy servers. EOL PHP RCE fix.
wakemeiflose / php2shell
CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress RCE PoC & Vulnerable Lab
pentestershell / php2shellbt
Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.
78ResearchLab / PHP2Shell-Full-Chain-Exploit
—
JoasASantos / php2shell-exploit
PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
murrez / php2shell
PoC for CVE-2026-109618 / CVE-2026-109619 (php2shell): PHP session.upload_progress UAF. check = GET fingerprint + bulk JSONL; exploit = smart 618 (multi-path trigger) or 619 with --call. Stdlib only.
cookiengineer / actual-php2shell
:robot: NO, There is an easy way to exploit this vulnerability! (vibecoded to prove a point)
Is4yev / php2shell-poc
CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework)
Qsnh / php2shell-fixed
宝塔面板（BT Panel）上已停止维护的 PHP 版本（5.4 – 8.1）的 PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修复包。仓库里有打好补丁的源码包，以及一键完成编译、替换、回滚的脚本。
aancw / php2shell-scanner
Scanner for PHP2Shell (CVE-2026-109618/109619): URL blackbox, local device and SSH.
xuehuolll / php2shell-CVE-2026-109618-109619
CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.
KarimUD7 / RCE-POCKET-POC-for-PHP2SHELL
Pocket proof-of-concept and lab materials for PHP2SHELL remote code execution research.
godylockz / cve-2026-109618-php2shell
Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell
iQingshan / php2shell
—
Ademking / php2shell-nuclei-templates
—
mikensec / php2shell-lab
Offline, reproducible lab to safely analyse an untrusted PoC for CVE-2026-109618/109619 and build detection rules. No exploit included; bring your own sample.