Repository Index

A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.

:cloud: Bash history in the cloud. Indexed and searchable.

• bash
• history
• cloud
• shell

Python low-interaction honeyclient

• honeyclient
• client-honeypot
• python
• security-tools

Remote Shell for MicroPython

High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)

Framework for Making Environmental Keyed Payloads (NO LONGER SUPPORTED)

• powershell
• golang
• python
• clueless-agents

Funky takes shell functions to the next level by making them easier to define, more flexible, and more interactive.

• bash
• aliases
• linux
• zsh

JShell - Get a JavaScript shell with XSS.

:hammer: Manage your website via terminal

• php
• security-tools
• python
• pentest

A simple shell based file explorer for ESP8266 Micropython based devices ⛺

ilastik-shell, applets, and workflows to string them together.

• ilastik
• machine-learning
• python
• qt

Operational information regarding the 2026 php2shell vulnerabilities

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

• cve-2026-109618
• cve-2026-109619
• exploit
• mod-php

HexaShell: a thin harness in which a coding agent drives a robot from RGB images and writes its own tools; frozen tools for the 42 RoboDojo tasks

Automated Tactics Techniques & Procedures

• empire
• tactics
• procedure
• cybersecurity

Shell agnostic git based dotfiles package manager, written in Python.

:hammer: A multiple reverse shell session/client manager via terminal

• socket
• python
• ctf
• attack-defense

PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE

Execute shell commands triggered by published MQTT messages

Cross-platform, open-source shellbag parser

CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)

Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design

• exploit
• php
• php2shell
• php2shell-cve

Visualize your shell usage with Highcharts!

• visualization
• highcharts
• bash
• web

PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12

• cve-2026-109618
• cve-2026-109619
• exploit
• memory-corruption