78ResearchLab/PHP2Shell-Full-Chain-Exploit
Can I trust it?
Worth a closer look before you use it.
Warnings Check
Very new: it was created yesterday. Wait a little before installing it.
Stars from real accounts No data
We haven't checked its stars for fakes yet.
Active OK
Last change today.
Licence OK
MIT: you can use it for free, also in a commercial product. Keep the licence notice.
Quick checks from public data. They help, but they are no guarantee.
What it is
Documents the PHP session.upload_progress use-after-free issue that can lead to remote code execution (CVE-2026-109618, CVE-2026-109619). Covers affected and fixed PHP versions, Snort and Suricata detection rules, and mitigation steps. Includes a Python exploit chain that the…
Who it's for
Security engineers and PHP server administrators assessing exposure to, or detection of, session.upload_progress exploitation
How to use it
Ask your AI to set it up
Paste this into Claude, ChatGPT or your coding assistant.
Help me install and set up 78ResearchLab/PHP2Shell-Full-Chain-Exploit in my project. Follow its README: https://github.com/78ResearchLab/PHP2Shell-Full-Chain-Exploit. Explain each step and check it is safe before running anything.
Star curve
Get alerts for repos like this
We'll email you when repos like this start rising. Free, once a week, only what matches.
19,302 GitHub repos watched and ranked every hour. Figures as of 23 October 2026.
What arrives: one email on Mondays with the repos that match, never more. See last week's. Privacy
For maintainers
Add this badge to your README. It shows the repo's place on the radar, updates every hour and links back to this page.
[](https://repoalerts.com/repo/78ResearchLab/PHP2Shell-Full-Chain-Exploit?ref=badge)Similar repos
- syrex1013/php2shell
Proof-of-concept exploit and lab for CVE-2026-109618 and CVE-2026-109619, a heap use-after-free in PHP's session.upload_progress handling. Includes a Docker lab reproducing the stale-pointer write on
- JoasASantos/php2shell-exploit
Python exploit framework for CVE-2026-109618 and CVE-2026-109619, a use-after-free in PHP's session.upload_progress handler that is described as enabling pre-auth remote code execution over HTTP. Incl
- devploit/php2shell
Research toolkit for the PHP session.upload_progress pre-auth RCE chain (CVE-2026-109618 / CVE-2026-109619) in mod_php. Provides a version-aware dispatcher, per-build profiles, Docker laboratories, he
- ikow/php2shell-poc
Research toolkit for two PHP pre-auth RCE vulnerabilities (CVE-2026-109618/109619) abusing session.upload_progress. Includes five chain descriptions, three exploit scripts, detection rules for Suricat
- junaire/CVE-2026-109618-exploit
Proof-of-concept exploit for CVE-2026-109618 and CVE-2026-109619, an unauthenticated remote code execution flaw in PHP's session.upload_progress handling, with a Docker target environment reproducing
- HOSTED-POWER/php_uploadprogress_guard
A small PHP extension that detaches the session upload-progress handler at startup and mirrors the official fix for CVE-2026-109618 and CVE-2026-109619 on unpatched PHP builds, without rebuilding PHP.