Stonlifer/php2shell
CVE-2026-109618 / CVE-2026-109619 — unauthenticated RCE in PHP's session.upload_progress handler (CVSS 9.2). Reproducible Docker lab against stock WordPress and Laravel on PHP 8.4.26, plus a read-only on-host audit script.
GitHub repository with 14 stars and 2 forks.
Language: Shell
Topics: cve, cve-2026-109618, cve-2026-109619, docker, exploit, laravel, penetration-testing, php, poc, rce