PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
Repository Index
64,764 visible repositories in the index
1–2 of 2 · Most stars
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
- cve-2026-109618
- cve-2026-109619
- exploit
- memory-corruption