PHP2Shell on Windows and macOS: Automating the PHP Upgrade, With or Without an Agent

Executive Summary PHP2Shell CVE-2026-109618 and CVE-2026-109619 allows unauthenticated remote code execution on exposed PHP servers. PHP has released fixed versions. On Linux, distribution packages carry the fix. On Windows and macOS, they don’t: Microsoft and Apple don’t ship PHP, so the fix is ...

CVE-2026-115243

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking...

CVE-2026-112244

The Duplicator and duplicator-pro WordPress plugins, in versions before 5.1.0 , are vulnerable to an unauthenticated full path disclosure . This issue occurs because the plugins do not prevent direct access to certain bundled PHP files. When these files are accessed outside of their expected cont...

CVE-2026-115243 WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking...

poc

PHP2Shell — Detection & Mitigation Guide PHP session.upload...

PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution

PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12 contain a use-after-free caused by request-owned global state that is not reset before the request heap is freed, letting unauthenticated attackers execute arbitrary code in a subsequent request handled by the same...

Invision Community <=5.0.6 Unauthenticated RCE via Template Injection

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by unauthenticated...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell — Exploitable Lab CVE-2026-109618 · CVE-2026-1096...

PT-2026-137289

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized PHP Object Injection, CWE-502, potentially leading to remote code execution...

CVE-2026-121925: Snowflake: A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions,…

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

PT-2026-136928

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp profile settings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key...

PT-2026-136943

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

The php2shell Recipe One recipe, any unpatched build → RC...

CVE-2026-121502

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and migh...

EUVD-2026-116212

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and migh...

CVE-2026-121502

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project within an unknown function of the facultydetails.php file. The vulnerability is triggered by manipulating the deleteid argument, allowing for remote execution of unauthorized SQL commands. The product follows a ro...

CVE-2026-121501

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function sessionregenerateid of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit ha...

CVE-2026-121501 mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function sessionregenerateid of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit ha...

CVE-2026-121501

A vulnerability exists in the mathurvishal CloudClassroom-PHP-Project involving the session_regenerate_id function within the loginlinkadmin.php file. Due to insufficient handling of the PHPSESSID argument, an attacker can perform a session fixation attack. This vulnerability can be exploited rem...