Critical Severity
CVE-2026-109618
Published: Oct 26, 2026
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 6 RCE chains, memory disclosure, scanner, detection rules, WAF mitigations, Docker labs. Authorized testing only.
<div align="center">
# PHP2Shell
```
██████╗ ██╗ ██╗██████╗ ██████╗ ███████╗██╗ ██╗███████╗██╗ ██╗
██╔══██╗██║ ██║██╔══██╗╚════██╗██╔════╝██║ ██║██╔════╝██║ ██║
██████╔╝███████║██████╔╝ █████╔╝███████╗███████║█████╗ ██║ ██║
██╔═══╝ ██╔══██║██╔═══╝ ██╔═══╝ ╚════██║██╔══██║██╔══╝ ██║ ██║
██║ ██║ ██║██║ ███████╗███████║██║ ██║███████╗███████╗███████╗
╚═╝ ╚═╝ ╚═╝╚═╝ ╚══════╝╚══════╝╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝
```
### 🎯 Critical PHP Remote Code Execution & Memory Disclosure
**4 Bugs · 6 Exploit Paths · 3 CMS Demos · Works on Linux & Windows**
<br>
[](https://nvd.nist.gov/vuln/detail/CVE-2026-109618)
[](https://nvd.nist.gov/vuln/detail/CVE-2026-109619)
[](https://www.first.org/cvss/)
[](https://www.php.net/)
<br>
[](https://github.com/memuratozturk/php2shell-poc/actions)
[](LICENSE)
[](https://python.org)
[](lab/docker-compose.yml)
[]()
<br>
[**Quick Start**](#-quick-start) · [**How It Works**](#-how-it-works) · [**Screenshots**](#-screenshots) · [**Documentation**](#-documentation)
</div>