PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PHP2Shell CVE-2026-109618: What to Do Right Now

borghq.io | vulnerability | CVE-2026-109618 | #incident-response | #borghq | #php2shell | #cve-2026-109618
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Facing PHP2Shell CVE-2026-109618? Here is what is verified before the 14:00 UTC patch, what remains unconfirmed, and your patch-day checklist.
CVE
CVE-2026-109618
Published
Collected

Related coverage

vulnerability · slcyber.io
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)
The research team releases an open source tool php2shell-scanner which contains a high fidelity scanning mechanism to check for CVE-2026-109618 and CVE-2026-109619 across hosts.
Critical · vulnerability · github.com
php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide
Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
Critical · vulnerability · github.com
CVE-2026-109618/109619: Two Independent Pre-Auth RCE Chains on PHP 8.5.11 (Lab Reproduction & PoC)
Provides definitive lab evidence and control ladders clarifying the actual exploitability of php2shell, refuting circulating unworkable cached-zval UAF theories while proving concrete RCE vectors on stock PHP 8.5.11.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
Critical · vulnerability · github.com
CVE-2026-109618 / CVE-2026-109619: PHP session.upload_progress Pre-Auth RCE PoC & Research
Affecting over a decade of PHP releases with session.upload_progress enabled by default, these flaws allow attackers to achieve pre-auth code execution through multiple independent vectors without relying on application-level file uploads.
vulnerability · hacktron.ai
PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)
Two unauthenticated RCE flaws in PHP, with exploitation attempts reported. Who is affected, how to check, and the fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.
Back