A proof-of-concept toolkit for two PHP pre-auth RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4.0 through 8.5.11, with exploits, detection rules, and a lab environment.
Useful for
- Reproduce the OOM-based RCE chain against a local PHP-FPM or mod_php lab container.
- Deploy the provided Suricata, Sigma, or ModSecurity rules to detect session.upload_progress exploitation attempts.
- Verify whether a target PHP version is vulnerable using the included PoC verification scripts.
Before using
- License: MIT
- Installation and requirements have not been verified; review the README before running
Why now
- Created on GitHub
- 2026-10-21 UTC
- First seen by GitNova
- 2026-10-21 UTC
- Magnitude
- 8.6 / 10 · growing interest
Not enough consecutive complete history days to compare daily gains
Measured: October 22, 2026, 06:26 UTC
Measurement details
- Created on GitHub: 2026-10-21; first seen by GitNova: 2026-10-21 (UTC)
- +221 stars measured 2026-10-22, 00:37–06:13 UTC
- Not enough consecutive complete history days to compare daily gains
- Magnitude 8.6/10