1.ikow / php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
+132 stars
from 1,790 · score 4.89
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
3 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.aarsaputra / php2shell
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
+34 stars
from 87 · score 3.56
3.dinosn / php-cve-2026-10961x-lab-poc
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
+2 stars
from 111 · score 1.10