Critical Severity
CVE-2026-109619
Published: Nov 11, 2026
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
<div align="center">
<img src="gambar/screenshot_1.png" alt="php2shell in action" width="720">
# 💀 P H P 2 S H E L L
### Unauthenticated RCE chain for PHP 5.4 → 8.4.26
*Pure HTTP · zero target-side requirements · JA3 fingerprint impersonation · proof-of-access design*
[](https://www.php.net)
[](https://www.first.org/cvss/)
[](#-verification)
[](#-the-5-lab-requirements)
[](LICENSE)
[](#-one-command-lab)
[](docs/index.html)
[Landing Page](docs/index.html) · [Install](#-install) · [Quick start](#-quick-start) · [Lab vs Live](#-lab-target-vs-live-target--read-this-before-running) · [Modes](#-modes) · [Repo sources](#-repo-sources--not-a-fork-but-a-derivative-of-several-repos) · [Research credits](#research-credits--who-found-it-who-wrote-it-down) · [How it works](#-how-it-works) · [Stealth](#-stealth--anti-bot-detection) · [FAQ](#-faq) · [Disclaimer](#-disclaimer--authorized-use-only)
</div>
> 🌐 **Landing Page & Web UI**: an interactive documentation page and simulation are available at [`docs/index.html`](docs/index.html). This static page can be served locally with `python3 -m http.server` inside the `docs/` folder.
---
## ❖ What is this?
`php2shell` is a **reproduction and research toolkit** for two critical PHP
vulnerabilities, **CVE-2026-109619** and **CVE-2026-109618*