PoC (104)
- eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
- junaire/CVE-2026-109618-exploit
- Zer061/CVE-2026-109618
PoC CVE-2026-109618 / -109619 (PHP session.upload_progress heap UAF)
- enactive-systems/CVE-2026-109618-poc
- mpyw/php-eol-CVE-2026-109618-109619
PHP 7.4 / 8.0 / 8.1 Docker images with the CVE-2026-109618 / CVE-2026-109619 fix backported
- xuehuolll/php2shell-CVE-2026-109618-109619
CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.
- godylockz/cve-2026-109618-php2shell
Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell
- 0x4148/CVE-2026-109618-php2shell-lab
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Docker lab and PoC. Use-After-Free in PHP's session.upload_progress.
- vperetti/php-cve-2026-109618-109619-backports
Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3
- slabbdev/php2shell-cve-2026-109618-109619
Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_progress, on by default since 5.4. Docker A/B (vulnerable vs patched builds), race harness, ASAN proof.
- WoYinDao/CVE-2026-109618-CVSS-9.2-Critical
PHP CVE-2026-109618/-109619 research archive: lab-conditioned chains (A/C), P1-P5 primitives, 3x ASAN conviction of an INDEPENDENT var_destroy UAF still alive on 8.4.27 (chainB/), official-patch diff analysis, 18-shot negative matrix. Patched: 8.2.35/8.3.36/8.4.27/8.5.12
- waksboy/fixed-fpm-cve-2026-109618-and-109619-images
Patches, Docker images and proofs for CVE-2026-109618 / CVE-2026-109619 on PHP 5.0 to 8.1 without an official release
- HackSpeak/CVE-2026-109618
PHP session.upload_progress attack-surface PoC/verification toolkit (php2shell claims, CVE-2026-109618/109619); for authorized lab testing
- mirrored-projects/PHP74-Windows-CVE2026
PHP 7.4 for Windows with CVE-2026-109618 / CVE-2026-109619-Backport
- AmpedWasTaken/PHP2Shell-CVE-2026-109618-CVE-2026-109619
- cloudducoeur/ansible-playbook-CVE-2026-109618
Temp fix with Ansible (CVE-2026-109618/CVE-2026-109619)
- Nayrae/CVE-2026-109618
A working PoC of the PHP2Shell exploit
- gumerzzzindo/php2shell-CVE-2026-109618-109619
Crónica y PoC del patch-day de PHP (21-oct-2026): CVE-2026-109618 / CVE-2026-109619 — RCE pre-auth en mod_php. Primitiva reproducida en stock 8.5.11 y en Nextcloud real. Lab-only.
- lzz0403/CVE-2026-109618-PHP2Shell-poc
PHP 8.2.6 + Apache mod_php
- cyberkiddle/CVE-2026-109618
The vulneurability causes RCE ending
- ivanscm/php80-cve-2026-109618
PHP 8.0.30 backport for CVE-2026-109618 / CVE-2026-109619 (Remi php80, EL7 RPMs)
- 1amrahul/php2shell-cve-2026-109618-cve-2026-109619
Independent verification of CVE-2026-109618 & CVE-2026-109619 (php2shell): kernel-proven session-lock-leak DoS on PHP 8.4.24, clean on patched 8.4.27, vendor OOM test suite 5-fail vs 0-fail. Lab, PoC scripts and full results - no weaponized exploit :)
- frnmrls/php70-cve-2026-backport
Unofficial minimal source backport of CVE-2026-109618 and CVE-2026-109619 (php2shell) for PHP 7.0.33
- pattingbabies/php2shell-CVE-2026-109618-109619
Full 1:1 reproduction of php2shell (CVE-2026-109618 / CVE-2026-109619): pre-auth PHP RCE via session.upload_progress OOM corruption and stale cross-request state. Pinned mod_php 8.4.26 / Apache 2.4.69 aarch64 lab, pure HTTP, heap-layout ASLR bypass, no brute force.
- Stensel8/check-for-CVE-2026-109618-CVE-2026-109619
- pruiz/php-CVE-2026-109618
Repo with stuff wrt CVE-2026-109618 backports & workarounds..
- ruddem/php-cve-2026-109618-109619
Bash-based security checker for PHP CVE-2026-109618 and CVE-2026-109619 across Linux, Docker and Kubernetes. Uses configurable fix-version thresholds to flag potentially vulnerable runtimes.
- zerbaliy3v/php2shell-CVE-2026-109618-CVE-2026-109619-Dorks
PHP2Shell PHP CVE-2026-109618 and CVE-2026-109619 dorks
- goodcoddeo/pterodactyl_PHP-CVE-2026-109618-CVE-2026-109619
Pterodactyl PHP security updater for Ubuntu 24.04 and Debian 12/13. AppliePHP security updates for CVE-2026-109618 and CVE-2026-109619 (critical RCE vulnerabilities).
- nirzadokox/php2shell-vulnerability-check-for-CVE-2026-109618-CVE-2026-109619
vulnerability check for CVE-2026-109618 / CVE-2026-109619
- EngOREOO/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
- SamJUK/php2shell-check-cve-2026-109618
Safely verify the October 2026 PHP OOM security fixes by testing patched runtime behaviour
- mefulton/CVE-2026-109618-analysis
Non-operational analysis and defensive guidance for CVE-2026-109618 and CVE-2026-109619
- Fazmin/PHP2Shell-CVE-2026-109618-CVE-2026-109619-Mitigation-Info-PoC
- absholi7ly/Deep-Technical-Report-CVE-2026-109618-CVE-2026-109619-PHP2Shell
- kishwordulal2005/CVE-2026-109618-and-CVE-2026-109619-Exploit
CVE-2026-109618 and CVE-2026-109619 exploit
- aduli198/CVE-2026-109618_CVE-2026-109619
PoC for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) zero-depndency, pre-auth RCE via a use-after-free in PHP's session.upload_progress handler. Affects PHP 5.48.5.11 fixed in 8.2.35+
- LeminEly/CVE-2026-109618-109619
PoC demonstrations for PHP vulnerabilities CVE-2026-109618 & CVE-2026-109619
- SeanDishman/php2shell-CVE-2026-109618-CVE-2026-109619
Example lab for CVE-2026-109618 / CVE-2026-109619 (php2shell): unpatched PHP session.upload_progress site + Python client.
- zhaoboy9692/CVE-2026-109618_
- sxyrxyy/php2shell-cve-2026-109618-check
Checks Linux and Windows servers for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell) and offers fixes, asking before each change
- zenzue/CVE-2026-109618_19
- zenzue/PoC-CVE-2026-109618_19
- daffa001/php-CVE-2026-109618-CVE-2026-109619
- 0xBlackash/CVE-2026-109618
CVE-2026-109618
- BIBILZERODAY/PHP2Shell-CVE-2026-109618-CVE-2026-109619-Mass-Exploit
- sorenjohanson/crowdsec-cve-2026-109618-rule
Initial version of custom CrowdSec rule for CVE-2026-109618 and CVE-2026-109619
- CYB3RW07F/PHP2Shell-CVE-2026-109618-CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619
- xvanpan/CVE-2026-109618
- LeonelArrua/CVE-2026-109618_CVE-2026-109619_Mitigate
Mitigation for CVE-2026-109618 and CVE-2026-109619 for PHP under 8.X
- debugactiveprocess/CVE-2026-109618
- EkaterinaMarchetti/Non-intrusive-PHP2Shell-assessment-for-CVE-2026-109618-and-CVE-2026-109619
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
- nsrg-fmlorg/php-cve-2026-109618
PHP php2shell (CVE-2026-109618, CVE-2026-109619) fixes for Rocky Linux 8, 9 and 10, following AlmaLinux's
- Okymi-X/CVE-2026-109618
php2shell — CVE-2026-109618 / CVE-2026-109619 PoC | Pre-auth RCE in PHP session.upload_progress (CVSS 9.2)
- 1o-ya/php-cve-2026-109618-hotfix-guide
Emergency mitigation guide and snippets for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell)
- charindithjaindu/CVE-2026-109618
- adriyansyah-mf/CVE-2026-109618-109619-PHP-session.upload_progress-Exploit-
- fmdiscioglu/php-cve-2026-109618-checker
Non-destructive affected-version checker for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) PHP OOM/longjmp UAF
- rdwr-namikb/php2shell-cve-2026-109618-109619-lab
Local verification lab for CVE-2026-109618 / CVE-2026-109619 (php2shell): PHP 8.4.4 vs 8.4.27
- wind884/CVE-2026-109618-109619-PHP2Shell
CVE-2026-109618 / CVE-2026-109619 (PHP2Shell): PHP RCE source audit, request lifecycle analysis and upstream patch review | PHP RCE 源码审计与补丁分析
- AvaterXXX/CVE-2026-109618-CVE-2026-109619-
- hirokidaichi/php56-cve-2026-backport-experiment
Experimental PHP 5.6.40 source backport for CVE-2026-109618 and CVE-2026-109619, with reproduction steps and test evidence. Not an official PHP release.
- DandanLLab/PHP-5.6.40-CVE-2026-109618-109619
php5 修复补丁CVE-2026-109618-109619
- alvaroguzmancode/CVE-2026-109618
- jsrobinson3/php74-focal-cve-2026-109618
- haobachang-1/php2shell-CVE-2026-109618-CVE-2026-109619
- mejustbox-byte/CVE-2026-109618-CVE-2026-109619
PHP Portal Audit: URL-only risk signals for CVE-2026-109618 / CVE-2026-109619, runtime assessment and optional multipart reachability evidence. No exploitation.
- lushinshang/php2shell-cve-2026-109618
PHP2Shell（CVE-2026-109618 / CVE-2026-109619）兩天全紀錄：以 php.net 官方公告為主軸的繁中深度導讀
- squiblyza/CVE-2026-109618-CVE-2026-109619
Passive exposure check for the PHP October 2026 RCE advisory (CVE-2026-109618 / CVE-2026-109619), with a Claude skill
- OmerAti/php-5.6.40-CVE-2026-109618-109619.patch
Important: PHP 5.6 is an end-of-life release. This patch should only be considered a security measure after its source changes have been reviewed and tested against the original PHP 5.6.40 codebase. Successful application and verification are required before claiming that either vulnerability is fixed.
- 1Nightlovel/CVE-2026-109618
php2shellscanner
- cozybear-dev/cve-2026-109618
- syrex1013/CVE-2026-109618
- cj667113/OCI-Ansible-Fix-CVE-2026-109618_CVE-2026-109619
PHP2Shell Audit and Fix
- hoehyeonlab/php-cve-2026-109618-check
Read-only checker + field-tested response guide for PHP CVE-2026-109618/109619 (unauthenticated RCE, CVSS 9.2). Detects vulnerable PHP on hosts and in Docker.
- skwirrel/php-cve-2026-109618-check
Check whether your own PHP 7.x-8.1 server still has the CVE-2026-109618 out-of-memory handling (install-on-server probe, not a scanner)
- basesixtythree/B63-POC-CVE-2026-109618
PoC and verification material for CVE-2026-109618 (PHP OOM bailout state corruption)
- nukIeer/CVE-2026-109618-109619-checker
Passive PHP version checker for CVE-2026-109618 / CVE-2026-109619 (php2shell)
- solymx/php-cve-2026-research
Research notes on CVE-2026-109618 / CVE-2026-109619 (PHP) - defensive analysis
- LightSpeedC/20261022-research-php-cve
PHP の RCE 脆弱性 CVE-2026-109618 / CVE-2026-109619 の調査
- 0k1dok1/CVE-2026-109618-CHECK
- HORKimhab/CVE-2026-109618-619
CVE-2026-109618, CVE-2026-109619
- ansonhsu-ai/php2shell-cve-2026-109618-ste
- TheMursalin/CVE-2026-109618
php2shell
- g41277460-cpu/CVE-2026-109618-CVE-2026-109619-php2shell-
cve explaination
- dos-security/CVE-2026-109618-CVE-2026-109619
Defensive PHP security advisories and safe verification guidance from DOS Security. CVE-2026-109618 · CVE-2026-109619
- yu1row/php-cve-2026-check
PHP CVE-2026-109618 / CVE-2026-109619 簡易確認スクリプト
- anldori/CVE-2026-109618
- mbadis-dev/php-cve-2026-109618-toolkit
- shivabalaj/CVE-2026-109618
- fardinbarashi/PHP-CVE-2026-109618-and-CVE-2026-109619
Check after php
- rmnelson/php-5.3.29-cve-2026-109618-109619
Unofficial PHP 5.3.29 backport of the php2shell fix (CVE-2026-109618, CVE-2026-109619) for Apache mod_php
- leonlai-tw/php-eol-cve-2026-109618-109619
Unofficial patches for PHP CVE-2026-109618 / CVE-2026-109619 (RCE, CVSS 9.2) on EOL platforms: PHP 7.3 on CentOS/RHEL 7 (Remi), PHP 5.4 on Amazon Linux 2, PHP 5.3 on Amazon Linux 1
- h3r2ym/Check-PHP-Docker-CVE-2026-109618---109619
- cred0core/Sigma-rule-CVE-2026-109618
Sigma rule detection for CVE-2026-109618 vuln
- SmR492/php-7.2-CVE-2026-109618-109619
Unofficial, unsupported source patch for end-of-life PHP 7.2 attempting to port the official PHP 7.4 backport for CVE-2026-109618 / CVE-2026-109619. No warranty, limited verification.
- SmR492/php-7.3-CVE-2026-109618-109619
Unofficial, unsupported source patch for end-of-life PHP 7.3 attempting to port the official PHP 7.4 backport for CVE-2026-109618 / CVE-2026-109619. No warranty, limited verification.
- Uzair-Baig0900/PHP2Shell-CVE-2026-109618-9
PHP2Shell is a critical security vulnerability affecting the PHP core engine, associated with CVE-2026-109618 and CVE-2026-109619. The vulnerabilities arise from improper memory management and request cleanup mechanisms, which can lead to Use-After-Free (UAF) and Type Confusion conditions.
- vitalelele/CVE-2026-109618-PoC
CVE-2026-109618 PoC - PHP session upload_progress heap UAF to pre-auth RCE. Docker one-liner demo included.
- GlobalsecureAcademy/php2shell-scanner-CVE-2026-109618-CVE-2026-109619-
php2shell Scanner
- mrmtwoj/php-cve-2026-109618-fixer
🛡️ ACYBER Security Toolkit — Automated detection & patching of CVE-2026-109618 (php2shell RCE) across Ubuntu, Debian, RHEL, CentOS, Rocky & AlmaLinux.
- baron-stybd/CVE-2026-109618-CVE-2026-109619
- Marciano-Morinigo/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-Lab
- eagle1maledetto/php5.6-wheezy-cve-2026-109618
PHP 5.6.40 packages for Debian 7 wheezy with the CVE-2026-109618 / CVE-2026-109619 fix (unofficial rebuild of the jessie packaging)