Repository Index

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

• cve-2026-109618
• cve-2026-109619
• detection-rules
• exploit

The Offensive Manual Web Application Penetration Testing Framework.

• web-penetration-testing
• reconnaissance
• vulnerability-analysis
• scanning-enumeration

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

• graphql
• security-scanner
• graphql-security
• api-documentation-tool

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

• tokenization
• web-security
• compliance
• security

cwe_checker finds vulnerable patterns in binary executables

• cwe
• binary-analysis
• static-analyzer
• vulnerability-scanner

The open-source AI security harness. Includes a web interface for code analysis, pentesting, vulnerability research, reverse engineering, verification, and fixing + CLI and MCP for agents.

• llm-agents
• security-research
• security-tools
• application-security

A DNS rebinding attack framework.

• dns-rebinding
• dns
• vulnerability
• attack

A modular vulnerability scanner with automatic report generation capabilities.

• artemis
• pentesting
• security
• security-scanner

Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.

• cve-scanning
• pentesting-tools
• rust
• vulnerability-scanners

Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.

Android Vulnerability Test Suite - In the spirit of open data collection, and with the help of the community, let's take a pulse on the state of Android security. NowSecure presents an on-device app to test for recent device vulnerabilities.

RockYou2021.txt is a MASSIVE WORDLIST compiled of various other wordlists. RockYou2021.txt DOES NOT CONTAIN USER:PASS logins!

• wordlist
• rockyou
• rockyou2021
• wordlists

Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.

• anti-crawling
• cloud-native
• crawler
• deception

The AI Agent for Cyber Security.

• ai-agent
• ai-security
• appsec
• bug-bounty

PoC for jsserver vulnerability in webOS 3.5+(?)

• exploit
• lg
• lgtv
• root

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

• application-security
• appsec
• bug-bounty
• burp-alternative

Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

• codereview
• cybersecurity
• ruby
• sinatra

phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code

• php
• php-codesniffer
• phpcs
• static-code-analysis

AI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP integration.

• ai
• attack-surface-management
• bbot
• cybersecurity

The repository host gives no description.

YakTrace reveals when multiple Yik Yak posts were made by the same anonymous account and organizes them into a local PDF dossier. Built on the sidechat.js API project.

• 0-day
• 0-day-exploit
• proof-of-concept
• vulnerability

teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.

• ids
• teler
• waf
• teler-ids

Operational information regarding the 2026 php2shell vulnerabilities