RepoAlerts
SponsorGet alerts

junaire/CVE-2026-109618-exploit

Get alerts like thisView on GitHubShare on X

Can I trust it?

Be careful with this one.

  • Warnings Check

    Very new: it was created yesterday. Wait a little before installing it.

  • Stars from real accounts No data

    We haven't checked its stars for fakes yet.

  • Active OK

    Last change today.

  • Licence Careful

    No licence: legally you can't reuse the code, unless the README says otherwise.

Quick checks from public data. They help, but they are no guarantee.

What it is

Proof-of-concept exploit for CVE-2026-109618 and CVE-2026-109619, an unauthenticated remote code execution flaw in PHP's session.upload_progress handling, with a Docker target environment reproducing a vulnerable nginx and php-fpm setup. Intended for authorized security testing.

Who it's for

Security researchers and penetration testers testing PHP applications for session.upload_progress exposure

How to use it

Install

docker build -t cve-2026-109618-exploit .

From its README. Check it there before running it.

Ask your AI to set it up

Paste this into Claude, ChatGPT or your coding assistant.

Help me install and set up junaire/CVE-2026-109618-exploit in my project. Follow its README: https://github.com/junaire/CVE-2026-109618-exploit. Explain each step and check it is safe before running anything.

Star curve

94From 80 to 94 stars between 21 Oct 2026 and 22 Oct 2026.

Get alerts for repos like this

We'll email you when repos like this start rising. Free, once a week, only what matches.

18,919 GitHub repos watched and ranked every hour. Figures as of 22 October 2026.

What arrives: one email on Mondays with the repos that match, never more. See last week's. Privacy

For maintainers

Add this badge to your README. It shows the repo's place on the radar, updates every hour and links back to this page.

[![junaire/CVE-2026-109618-exploit on RepoAlerts](https://repoalerts.com/badge/junaire/CVE-2026-109618-exploit.svg)](https://repoalerts.com/repo/junaire/CVE-2026-109618-exploit?ref=badge)
Share on X
  • Zer061/CVE-2026-109618

    Proof-of-concept exploit for CVE-2026-109618 and CVE-2026-109619, a heap use-after-free in PHP's session.upload_progress handling. The repository provides exploit.py, which targets a PHP 8.4.26 and Ap

    Dev infrastructurePython · 57 stars · +57 this week · 1 day old

  • syrex1013/php2shell

    Proof-of-concept exploit and lab for CVE-2026-109618 and CVE-2026-109619, a heap use-after-free in PHP's session.upload_progress handling. Includes a Docker lab reproducing the stale-pointer write on

    Python · 47 stars · +47 this week · 1 day old

  • eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

    Proof-of-concept exploit for two PHP core vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution in vulnerable PHP environments. Includes a README with affected version

    Shell · 656 stars · +656 this week · 1 day old

  • HOSTED-POWER/php_uploadprogress_guard

    A small PHP extension that detaches the session upload-progress handler at startup and mirrors the official fix for CVE-2026-109618 and CVE-2026-109619 on unpatched PHP builds, without rebuilding PHP.

    LibraryDev infrastructureC · 58 stars · +58 this week · 1 day old

  • dinosn/php-cve-2026-10961x-lab-poc

    Lab reproduction and vulnerability-research package for PHP 8.5.11 CVE-2026-109618 and CVE-2026-109619, a remote code execution chain using memory disclosure via session cookies and a use-after-free.

    Python · 62 stars · +62 this week · 1 day old

  • ikow/php2shell-poc

    Research toolkit for two PHP pre-auth RCE vulnerabilities (CVE-2026-109618/109619) abusing session.upload_progress. Includes five chain descriptions, three exploit scripts, detection rules for Suricat

    Python · 1,103 stars · +1,103 this week · 1 day old