1.ikow / php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
+132 stars
from 1,790 · score 4.89
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
8 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.devploit / php2shell
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
+106 stars
from 161 · score 4.67
3.aarsaputra / php2shell
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
+34 stars
from 87 · score 3.56
4.hugsy / gef
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
+16 stars
from 8,401 · score 2.83
5.Gallopsled / pwntools
CTF framework and exploit development library
+14 stars
from 13,790 · score 2.71
6.AzeemIdrisi / PhoneSploit-Pro
An all-in-one hacking tool to remotely take over Android devices.
+12 stars
from 6,409 · score 2.56
7.dinosn / php-cve-2026-10961x-lab-poc
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
+2 stars
from 111 · score 1.10
8.nccgroup / featherduster
An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
+1 stars
from 1,140 · score 0.69