Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Vulnerability overview On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities both rated 9.2 on the CVSS scale. The patches were released on Wednesday, October 21, 2026, at 14:00 UTC. The releas...

PHP2SHELL-POC

██████╗ ██╗ ██╗██████╗ ██████╗ ███████╗██╗ ██╗███████╗██╗...

Exploit for CVE-2026-109618

php2shell — CVE-2026-109618 / CVE-2026-109619 PoC Heap Us...

Exploit for CVE-2026-109618

🛡️ Complete Report on the PHP "Upload Progress" Vulnerability...

testofPOC

CVE-2026-109618 / CVE-2026-109619 — PHP session.uploadprogre...

php2shell-exploit

CVE-2026-109618 / CVE-2026-109619 — PHP session.uploadprogre...

Exploit for CVE-2026-109618

php2shell CVE-2026-109618 / CVE-2026-109619. Pre-auth RCE thr...

Exploit for CVE-2026-109618

php2shell - PoC for CVE-2026-109618 / CVE-2026-109619 Proof-o...

Exploit for CVE-2026-109618

PHP: PHP2Shell CVE-2026-109618 and CVE-2026-109619 PHP CVE-20...

Exploit for CVE-2026-109619

CVE-2026-109619 Cross-request use-after-free in PHP's se...

Exploit for CVE-2026-109618

Top-level bundle readme layout, quickstart, credits php-up-2...

Exploit for CVE-2026-109618

php2shell - PoC for CVE-2026-109618 / CVE-2026-109619 Proof-o...

Exploit for CVE-2026-109618

Emergency Mitigation Measures for PHP CVE-2026-109618 / CV...

Exploit for CVE-2026-109618

php2shell — CVE-2026-109618 / CVE-2026-109619 Pre-authenticat...

php2shell-poc

php2shell — CVE-2026-109618 / CVE-2026-109619 Research Independent security research on the critical PHP session.uploadprogress vulnerabilities CVSS v4.0 9.2. Author: Qi Deng @ikow Date: 2026-10-21 Full writeup: qideng.substack.com Overview Two critical pre-auth RCE vulnerabilities in PHP core's...

Exploit for CVE-2026-109618

PoC CVE-2026-109619 !CIhttps://github.com/jackalsyn-sec/p...

php2shell_PoC

PHP2Shell PoC — stale bytesprocessed in the session upload-...

Exploit for CVE-2026-109618

CVE-2026-109618 / CVE-2026-109619 - PHP2Shell !PHPhttps://...

Exploit for CVE-2026-109618

php2shell — CVE-2026-109618 / CVE-2026-109619 Research Indepe...

Exploit for CVE-2026-109618

PHP session.uploadprogress — cross-request use-after-free...