mod-php

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

Docker-environment for web-development on PHP

Simple tool for downloading sticker images and assets in a zip from LINE Store

Drop-in php:7.4-apache/fpm/cli Docker images with the official fix for CVE-2026-109618 / CVE-2026-109619 (critical PHP RCE). amd64 + arm64.

Wazuh detection content for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): 6 rules, 3 decoders, Apache LogFormat and an SCA policy. Validated on Wazuh 4.14.8 (4.14.x series), Ubuntu 24.04.5, Apache 2.4.58 and PHP 8.3.6.

Working local PoC for the php2shell PHP RCE pair (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution via session.upload_progress multipart OOM in Apache mod_php. Docker A/B lab (8.4.26 vs 8.4.27), exploit patch for emulated x86-64, and patch-verification methodology.

PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 5 chains + JA3 stealth + mass scan + safe webshell. Authorized testing only.

Install Apache and PHP with modphp

Full 1:1 reproduction of php2shell (CVE-2026-109618 / CVE-2026-109619): pre-auth PHP RCE via session.upload_progress OOM corruption and stale cross-request state. Pinned mod_php 8.4.26 / Apache 2.4.69 aarch64 lab, pure HTTP, heap-layout ASLR bypass, no brute force.

Educational Docker lab for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP 8.4.x

Pre-auth RCE lab for CVE-2026-109618/CVE-2026-109619 - PHP session.upload_progress heap chain

Apache + PHP for a simple, manageable process model.

In-depth technical verification, ASLR boundary analysis, and memory defaults impact for CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) CVE-2026-115560

Safely patch PHP on Ubuntu + Apache: audit, upgrade, FPM migration, and cleanup. Backup-first, for the Oct 2026 PHP security releases.

Find every PHP on a host, in its containers and in popular images, and prove it has the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619). Version and config checks only.

Compare Moodle in Various Web Server & Runtime with K6

A test harness to play around with PHP's Memcached client and persistent connections in Apache/mod_php.

php2shell (CVE-2026-109618/109619) 利用工具：带来源与日期的指纹库、两条引擎、免 gdb 标定；含源码级结论——本链下限 PHP 7.0。

PHP2Shell PoC for GHSA-w8hw-w9fx-j79w / CVE-2026-109618 — PHP OOM longjmp memory corruption. Validated OOM producers and dangling session-state worker crash on PHP 8.4.26 mod_php, with instrumented lab and full report.

REDZ.TECH security patches for end-of-life PHP (5.2–8.1): fixes for critical vulnerabilities the PHP project no longer ships for old branches. Патчи безопасности для старых версий PHP.