Critical Severity
CVE-2026-109619
Published: Oct 25, 2026
Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619) Recon → Passive Fingerprinting → Behavioral Probing → WAF Diagnostics) and separately opt-in exploit/shell functions.
# 🔬 PHP2Shell — Research & Exploitation Toolkit (v2.2.1)
<p align="center">
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109618"><img src="https://img.shields.io/badge/CVE--2026--109618-CRITICAL%20(9.2)-e74c3c?style=for-the-badge" alt="CVE-2026-109618"></a>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109619"><img src="https://img.shields.io/badge/CVE--2026--109619-CRITICAL%20(9.2)-e74c3c?style=for-the-badge" alt="CVE-2026-109619"></a>
<a href="https://www.exploit-db.com/exploits/52704"><img src="https://img.shields.io/badge/EXPLOIT--DB-%2352704-e67e22?style=for-the-badge" alt="Exploit-DB #52704"></a>
<a href="https://portal.offsec.com/machine/cve-2026-109618-255610/overview/"><img src="https://img.shields.io/badge/OFFSEC%20LAB-100%25%20SOLVED-27ae60?style=for-the-badge" alt="OffSec Lab 100% Solved"></a>
</p>
<p align="center">
<img src="https://img.shields.io/badge/PYTHON-3.9+-3776AB?style=for-the-badge&logo=python&logoColor=white" alt="Python">
<a href="php2shell.py"><img src="https://img.shields.io/badge/TOOLKIT-V2.2.1-2ecc71?style=for-the-badge" alt="Toolkit"></a>
</p>
<p align="center">
<strong>Comprehensive research, defensive auditing, and unified exploitation suite for CVE-2026-109618 & CVE-2026-109619 — critical PHP core vulnerabilities.</strong><br>
<em>Features an all-in-one script (<code>php2shell.py</code>) with assessment phases (Recon → Passive Fingerprinting → Behavioral Probing → WAF Diagnostics) and separately opt-in exploit/shell functions.</em>
</p>
---
## 📋 Vulnerability Overview
PHP2Shell provides discovery, differential analysis, and weaponized verification for two critical remote vulnerabilities in PHP's core memory allocator and multipart request parsing subsystems:
| CVE | Vulnerability Type | CVSS | Affected Branches | Fixed Releases |
|---|---|---|---|---|
| **CVE-2026-109618** | RFC 1867 OOM Uninitialized Memory Corruption | **9.2** Critical | PHP 5.4 – 8.2 (< 8.2.35), 8.3 (<