Critical Severity
CVE-2026-109619
Published: Oct 27, 2026
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
<div align="center">
<img src="gambar/screenshot_1.png" alt="php2shell in action" width="720">
# 💀 P H P 2 S H E L L
### Unauthenticated RCE chain for PHP 5.4 → 8.4.26
*Pure HTTP · zero target-side requirements · JA3 fingerprint impersonation · proof-of-access design*
[](https://www.php.net)
[](https://www.first.org/cvss/)
[](#-verification)
[](#-the-5-lab-requirements)
[](LICENSE)
[](#-one-command-lab)
[](web/index.html)
[Landing Page](web/index.html) · [Install](#-install) · [Quick start](#-quick-start) · [Lab vs Live](#-lab-target-vs-live-target-baca-ini-sebelum-menjalankan) · [Modes](#-modes) · [Sumber repo](#-sumber-repo-bukan-fork-tapi-turunan-beberapa-repo) · [Kredit riset](#kredit-riset--siapa-menemukan-siapa-menuliskan) · [How it works](#-how-it-works) · [Stealth](#-stealth-anti-bot-detection) · [FAQ](#-faq) · [Disclaimer](#-disclaimer-authorized-use-only)
</div>
> 🌐 **Landing Page & Web UI**: Dokumentasi interaktif dan simulasi tersedia di [`web/index.html`](web/index.html). Halaman statis ini bisa diakses lokal via `python3 -m http.server` di folder `web/`.
---
## ❖ What is this?
`php2shell` is a **reproduction and research toolkit** for two critical PHP
vulnerabilities — **CVE-2026-109619** and **CVE-2026-109618** (CVSS 4.0 **9.2
Critical**, unauthenticate