Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
-
Updated
Oct 24, 2026 - Python
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
Hybrid PHP2Shell Security Toolkit (CVE-2026-109618 & 109619). Features an automated vulnerability scanner, session-state analyzer, and application upload handler validator. For authorized security testing only.
Detect php2shell (CVE-2026-109618 / CVE-2026-109619) on remote PHP targets — behavioral multipart probes, version fallback, async CLI in PHP.
php2shell CVE-2026-109618 CVE-2026-109619 tracks php2shell, cve php2shell and php2shell cve. php2shell vulnerability plus php cve 2026 (cve php 2026), php cve patch: 8.5.12, 8.4.27, 8.3.36, 8.2.35. php cve rce, php security.
Loopback-only PHP session serialize-handler mismatch lab with a harmless proof and negative control
PHP Runtime Vulnerability Assessment Toolkit — CVE-2026-109618 & CVE-2026-109619
Research case study on two critical PHP flaws that leaked before the patch. Covers impact, mitigation, and the AI angle. No exploit code, based on public sources.
Published indicators and a log-hunting guide for the PHP2Shell PHP flaws (CVE-2026-109618, CVE-2026-109619)
Security mitigations and auditing tools shared for the public good. 💞
To associate your repository with the php2shell-vulnerability topic, visit your repo's landing page and select "manage topics."