php2shell

php2shell vulnerabilities CVE-2026-109618, CVE-2026-109619 Operational information last significant change: 21 October 2026 17:25 CEST Software list last status update: 22 October 2026 17:23 CEST TLP:CLEAR This repository contains operational information regarding the critical PHP vulnerabilities...

php-eol-cve-2026-109618-109619

CVE-2026-109618 / CVE-2026-109619 patches for end-of-life PHP 7.3 on EL7, 5.4 / 5.3 on Amazon Linux Unofficial backports of the PHP security team's minimal mitigation for the two critical, unauthenticated remote code execution vulnerabilities announced on 2026-10-21: CVE| Advisory| Summary...

BUGS_OOM_NULL_PTR_DEREF

BUGSOOMNULLPTRDEREF BUGS ON ANDROID NULL PTR DEREF, OOM JUST FOR LULZ...

EUVD-2026-110023

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine...

CVE-2019-12401

CVE-2019-12401: XML Bomb in Apache Solr Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack a.k.a. Lol Bomb via its update handler. By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shellaudit A small, dependency-free detector for PHP2S...

php2shell-lab

php2shell-lab Lab reproduction, exposure probe and detectio...

PoC_CVE-2025-11579

PoC CVE-2025-11579 Overview rardecode versions = 2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash. Exploit We craft a RAR file with an...

VLC-CVE-2008-4654-Exploit

VLC-CVE-2008-4654-Exploit Well, it's just an old vulnerability whose CVE number is CVE-2008-4654. This vulnerability is caused by Out of Memory at line 1650 of modules/demux/ty.c. streamReadpdemux-s, mstbuf, 8 + imapsize; When I downloaded the EXP from other websites, I found that it doesn't work...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell exposure checks CVE-2026-109618 / CVE-2026-109619...

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities KEV catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate...

Linux Distros Unpatched Vulnerability : CVE-2026-99004

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 drm/imagination: Fix page count for page table for map interface passed the...

CVE-2026-72758 Routinator may exit on malformed ranges

When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory...

EUVD-2026-110031

When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory...

CVE-2026-72753

The Routinator software contains a vulnerability related to how it handles RRDP notification files . When the software encounters a file with gaps in the delta entries , it incorrectly accepts and parses the data, which may result in missing data . Additionally, processing a file with an excessiv...

CVE-2026-115913 vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mmaudio.py and phi4mmutils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forwardattenti...

CVE-2026-115913 vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mmaudio.py and phi4mmutils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forwardattenti...

CVE-2026-115913

Prior to version 0.32.0 , the vLLM inference and serving engine is vulnerable to a Denial of Service (DoS) condition via its Phi-4 multimodal audio encoder. Specifically, the components phi4mm_audio.py and phi4mm_utils.py use eager attention by default, causing MultiHeadedAttention.forward_attent...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

A remote scanner and research PoC for the PHP2SHELL RCE pair —re...

CVE-2026-115721

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP Jabber server library. As this project is retired, we do not plan to release a version...