php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discovery, SAPI profiling, OOM fuzzing calibration, and FPM worker pinning. Stdlib only.
☆104Oct 23, 2026Updated 2 weeks ago
Alternatives and similar repositories for php2shell
Users that are interested in php2shell are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆28Oct 25, 2026Updated 2 weeks ago
- CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.☆52Oct 26, 2026Updated 2 weeks ago
- Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP e…☆1,080Oct 22, 2026Updated 3 weeks ago
- Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell☆42Nov 2, 2026Updated last week
- ASLR-bypassing RCE PoC for PHP's session.upload_progress chain (CVE-2026-109618 / CVE-2026-109619). Single file, no gdb, no /proc - addre…☆12Oct 21, 2026Updated 3 weeks ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE. Split-controller upload bypass. CVSS 9.8 | CWE-434 | com_rsfi…☆16Jul 29, 2026Updated 3 months ago
- wp2shell — WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.☆17Jul 19, 2026Updated 3 months ago
- Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.☆82Oct 22, 2026Updated 3 weeks ago
- CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework)☆63Oct 22, 2026Updated 3 weeks ago
- collection of various nuclei templates☆11Apr 18, 2023Updated 3 years ago
- Android app. Client for Bluetooth serial connections (RFCOMM), with custom terminal emulator.☆15Jun 5, 2020Updated 6 years ago
- CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, hea…☆296Oct 30, 2026Updated last week
- CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit rese…☆1,962Oct 28, 2026Updated 2 weeks ago
- ☆24Jul 7, 2026Updated 4 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- MacInjector is a tool that lists macOS applications, checks code-signing vulnerabilities, and injects a dynamic library (dylib) into a vu…☆18Oct 8, 2025Updated last year
- ☆144Oct 21, 2026Updated 3 weeks ago
- Script free untuk brute force Facebook public dengan login mengunakan cookie, GK minta apa apa cuma minta star nya aja🙏☆20Mar 1, 2026Updated 8 months ago
- An example of a FUSE filesystem that can be used in kernel exploitation as a replacement for userfaultfd technique☆12Nov 24, 2022Updated 3 years ago
- A lightweight Linux desktop extension for managing V2Ray proxy connections with ease.☆23Oct 20, 2026Updated 3 weeks ago
- Remote HTTP-only RCE on PHP 8.4.26 + Apache prefork/mod_php (ASLR bypass via session.upload_progress UAF) — self-contained Docker lab, on…☆42Oct 22, 2026Updated 3 weeks ago
- Bruteforce HTTP Authentication. Supports: Basic HTTP authentication ,Digest HTTP authentication☆12Jul 7, 2026Updated 4 months ago
- https://heyitsas.im/posts/ovswrap☆20Jul 28, 2026Updated 3 months ago
- The Faction Burp Suite Extension☆16Oct 8, 2026Updated last month
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- wordpress xmlrpc + wp-login.php brute force☆16Mar 13, 2021Updated 5 years ago
- CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)☆36Oct 28, 2026Updated 2 weeks ago
- AD concepts, attack surfaces and attack vectors notes, slides, video...☆17Dec 6, 2024Updated last year
- php2shell WordPress RCE proof of concept (PHP 8.3.35 / WordPress 7.1.2)☆34Oct 23, 2026Updated 2 weeks ago
- ☆22Dec 13, 2025Updated 10 months ago
- Optimal placement of uav through machine learning methods in 4G newtwork☆10May 11, 2020Updated 6 years ago
- ☆10Mar 11, 2025Updated last year
- CVE-2026-50522 PoC☆44Aug 15, 2026Updated 2 months ago
- ☆99Updated this week
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- ☆99Oct 22, 2026Updated 3 weeks ago
- PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE☆198Oct 26, 2026Updated 2 weeks ago
- CVE-2026-34486 Apache Tomcat EncryptInterceptor 绕过漏洞复现（使用GLM5.1复现完成）☆12Apr 15, 2026Updated 6 months ago
- 🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 — session.upload_progress 文件名注入 + LFI → RCE，Docker 一键启动，附中文原理分析与 PoC☆35Oct 21, 2026Updated 3 weeks ago
- CVE-2026-41940 latest cPanel & WHM 0day - 70 million websites are possible to expose by Chirag Artani☆26Apr 29, 2026Updated 6 months ago
- High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)☆1,001Oct 24, 2026Updated 2 weeks ago
- POC Utilizing the new SleepMask-VS kit to utilize RC4 encryption.☆12Mar 4, 2025Updated last year
Are these results useful?