dinosn/php-cve-2026-10961x-lab-poc
- Total stars
- 109
- Today
- +0since 00:10 UTC
More actions
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
Save to My finds to follow releases and star growth. Saved in this browser.
About the project
Lab PoC for the PHP 8.5.11 RCE chains CVE-2026-109618/109619: unauthenticated code execution via four HTTP requests, address disclosure through PS(id)→cookie and a UAF, plus a check of the 8.5.12 patch.
Useful for
- Reproduce the RCE chain on the php:8.5.11-apache image in an isolated lab
- Verify whether the 8.5.12 patch closes both CVEs on a GPG-verified build
- Assess WAF bypass via the Content-Type separator in multipart/form-data
README summarized by DeepSeek V4.1 Flash. Details may be inaccurate. Read the original README →
Star growth looks organic. Data as of October 25, 2026, 01:01 UTC.
The star-growth assessment does not verify whether the project is safe to run.
Stars per day
Bars show stars per UTC day; the line is a moving average of available history. Gaps mean missing data, not zero growth. Today's bar is incomplete. Red marks spike days.
Why it’s trending
- Star-counter measurements on 2026-10-25 (UTC), 00:10–00:56: 109 → 109 stars (+0). This is the change over that interval.
- Estimated end-of-day forecast: about +2 stars, using observed gains and the previous day.
- The repository is 5 days old and already has 109 stars. With less than two weeks of history, there's no usual pace to compare the spike against yet.
- Top new repositories this week: #192.
- Hacker News: “PHP2Shell: AI uncovers critical RCE in PHP” — 454 points, 3 days ago.
Measured growth: the last 7 completed days
The full 7-day window is unavailable; no weekly total or comparison is calculated.
Daily measurements · UTC
- October 18, 2026
- —
- October 19, 2026
- —
- October 20, 2026
- 1
- October 21, 2026
- 66
- October 22, 2026
- 31
- October 23, 2026
- 9
- October 24, 2026
- 2
Largest measured day in the last 30 days: 66 · October 21, 2026. Days with data: 5.
Completed days come from GitHub star history; today and forecasts are excluded from this comparison. History checked: October 25, 2026, 01:00 UTC. Sources and measurement limits →
Three GitHub discoveries in each edition
What they do, why they are gaining interest, and what to check before using them.
Editions at 10:00, 16:00, 22:00 MSK.
Numbers
- Total stars
- 109
- Today
- +0 stars measured 2026-10-25, 00:10–00:56 UTC, ≈ 2 by evening
- Forks
- 24
- Issues and pull requests
- 0
- Watchers
- 0
- Language
- Python
- Created
- October 20, 2026
- Last push
- October 23, 2026
Star trust
Growth looks organic: forks and discussion are in line with active projects, and stars arrive unevenly, the way people give them.
These are heuristics, not a verdict: we judge by the repository’s behavior, not by a list of stargazers.
Hacker News discussions
- PHP2Shell: AI uncovers critical RCE in PHP454 points, October 21, 2026
Spotted in
- October 25, 2026Top new repositories this week: #190
README badge
Paste it into your README — the badge shows the current magnitude and links to this page.
[](https://gitnova.dev/en/r/dinosn/php-cve-2026-10961x-lab-poc)