dinosn/php-cve-2026-10961x-lab-poc
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
GitHub repository with 113 stars and 27 forks.
Language: Python
Topics: cve-2026-109618, cve-2026-109619, exploit, memory-corruption, php, php2shell, rce, rfc1867, security-research, session-upload-progress