ikow/php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
php2shell CVE-2026-109618 & CVE-2026-109619 — PHP Pre-Auth RCE Exploit & Detection Toolkit Exploits · Detection · Lab · Writeup Five independent RCE chains exploiting PHP's session.uploadprogress and the Zend engine's OOM bailout. 14 years of vulnerable code — PHP 5.4.0 (2012) through 8.5.11. Pre-auth. No application vulnerability required for some chains. Impacts 78% of all websites — including WordPress (43%), Joomla, Drupal, Laravel, Magento, and every default PHP installation. Author: Qi Deng | Writeup: Substack | Date: 2026-10-21 Patch: Commit 3584a98 — 300 files changed across the Zend engine. Chain D is the most critical: zero-dependency pre-auth RCE against any Apache modphp installation. Chain E is nearly as broad on FPM: the producer needs any endpoint that calls sessionstart() (near-universal — WordPress, Laravel, Joomla, Drupal all do), and the consumer can be any PHP endpoint — the rfc1867 uploadprogress handler runs during SAPI startup before application code. Verified:…
Read the full README ↗ · Preview checked 2026-10-27T17:32:29.140Z
Inside the original README — Document outline
- CVE Details
- Attack Chains
- Exploits
- Detection Rules
- Quick Start
- Repository Structure
- Mitigation
- Downstream Impact
- References
- Disclaimer
- License
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Documentation belongs to its respective authors. Reported project/model license: MIT. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
Repository facts
- Owner
- ikow
- Primary language
- Python
- Stars
- 1,913
- Forks
- 649
- Open issues + pull requests
- 1
- License
- MIT
- Archived
- No
- Default branch
- main
- Created
- 2026-10-21T07:55:16.000Z
- Last push
- 2026-10-28T23:21:57.000Z
Topics and intended use
Owner-supplied topics: cve-2026-109618, cve-2026-109619, detection-rules, exploit, php-exploit, php-security, php2shell, poc, rce, session-upload-progress, suricata-rules, vulnerability-research, waf-rules, wordpress-security
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-10-31T12:18:20.650Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.
Related repositories
EbookFoundation/free-programming-books
donnemartin/system-design-primer