alvarodh5/php2shell
ASLR-bypassing RCE PoC for PHP's session.upload_progress chain (CVE-2026-109618 / CVE-2026-109619). Single file, no gdb, no /proc - addresses leaked in-band via Set-Cookie. PHP 8.4.26 & 8.5.11.
GitHub repository with 11 stars and 7 forks.
Language: Python
Topics: aslr-bypass, cve-2026-109618, cve-2026-109619, exploit, php, rce, session-upload-progress