## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Protocols.MessagePack; MessagePack; MessagePack.Annotations; MessagePackAnalyzer. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignalR's MessagePack protocol can consume excessive memory while deserializing deeply nested attacker-controlled arrays, resulting in unauthenticated remote denial of service. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/473 ## CVSS Details - **Version:** 3.1 - **Severity:** Moderate - **Score:** 5.3 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` - **Weakness:** CWE-1325 (Improperly Controlled Sequential Memory Allocation) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## <a name="affected-packages"></a>Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 10.0.0, <= 10.0.12 | 10.0.13 [Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 11.0.0-preview.5, <= 11.0.0-rc.1 | 11.0.0-rc.2 [Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 8.0.0, <= 8.0.31 | 8.0.32 [Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 9.0.0, <= 9.0.20 | 9.0.21 ## Advisory FAQ ### <a name="how-affected"></a>How do I know if I am affected? If using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability. ### <a name="how-fix"></a>How do I fix the issue? 1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. 2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command. Once you have installed the updated runtime or SDK, restart your apps for the update to take effect. Additionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed. ## Other Information ### Reporting Security Issues If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue). Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty. ### Support You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue. ### Disclaimer The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. ### External Links [CVE-2026-92707](https://www.cve.org/CVERecord?id=CVE-2026-92707) ### Acknowledgements Anonymous ### Revisions V1.0 (10/13/2026): Advisory published.
PoC: node2shell-poc
ZeroHack: Node2Shell (CVE-2026-111497) Docker Lab & PoC Framework
PoC: PHP2Shell
Full-pipeline research, passive audit, active behavioral scanner, and automated exploitation toolkit for PHP Core CVE-2026-109618 & CVE-2026-109619 (PHP2Shell / EDB-52704).
PoC: php2shell-lab
Black-box pentest lab for the PHP2Shell engine memory-corruption family (CVE-2026-109618 / CVE-2026-109619, CVSS 9.8/9.2). Dual-flag verified attack chain, agent-calibrated. EN/JP/ZH.
PoC: php2shell
PHP2Shell proof of concept for CVE-2026-109618 and CVE-2026-109619, with Docker labs and build-specific profiles for security research.
PoC: CVE-2026-98260-popsicle-android
Target-specific Android CVE-2026-98260 research port for Xiaomi popsicle
PoC: PHP2SHELL-DEFENSIVE-KIT
Defensive research and tooling for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)** - two critical memory-safety vulnerabilities in the PHP engine disclosed with the PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 security releases (2026-10-21).
PoC: php2shell-cve-2026-109618
PHP2Shell (CVE-2026-109618/109619): mod_php pre-auth heap-corruption RCE — working PoC, non-destructive checker, per-build offset recovery for stripped distro packages, lab harness
PoC: node2shell-detect
Detect systems affected by Node2Shell (CVE-2026-111497) on Unix and Windows
PoC: orcacyber-php2shell-research
PHP2Shell (CVE-2026-109618/109619) security research and PoC validation using OrcaCyber Zero & Ultra. Includes technical analysis, RCE evidence, and defensive verification tools.
PoC: php-vulnerability-checker-and-fix
PHP vulnerability checker and fix: free read-only checker, guided patch script and AI agent skill for PHP2Shell (CVE-2026-109618, CVE-2026-109619). Docker, cPanel, Plesk, DirectAdmin, CloudLinux, shared hosting, VPS. WordPress, Magento, Laravel. PHP 5 to 8.5.
PoC: php2shell-engine-rce
Engine-level PHP2SHELL (CVE-2026-109618/109619) lab: stock PHP 8.4.26 mod_php RCE, interactive exploit, multi-worker/TLS/OOB, Docker evidence.
PoC: cve-2026-34717-exploit
Boolean-based Blind SQLi exploit for CVE-2026-34717 (OpenProject 17.2.0)Boolean-based Blind SQLi exploit for CVE-2026-34717 (OpenProject 17.2.0)
PoC: php-sentinel
Reverse proxy that blocks PHP parser exploits (CVE-2026-109618/109619) by replaying requests through an 11-version canary array. Compensating control for EOL PHP 5.6–8.1.
PoC: woxeshell
Detection-only scanner for CVE-2026-109618 & CVE-2026-109619 (PHP). Authorized testing only.
PoC: CVE-2026-108551-POC
Defense guide + static scanner for CVE-2026-108551 (openapi-typescript-codegen code injection).
PoC: br-php2shell
Descubra se sites da internet é vulnerável a php2shell CVE-2026-109619
PoC: python-pillow-rce-cve-2026-112900
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC: php2shell-remediate
CVE-2026-109618/109619 (php2shell) PHP exposure classifier and remediation planner. BSD-2-Clause.
PoC: php2shell-tools
Read-only triage tools for the October 2026 PHP remote-code-execution flaws: CVE-2026-109618 / CVE-2026-109619 / CVE-2026-110447
PoC: i-can-count-to-four
Scan a filesystem for traces of the compromised eMudhra CA certificates (CVE-2026-111943) and get an upgrade plan
PoC: CVE-2026-98260-nezha-android
Target-specific Android CVE-2026-98260 research port for Xiaomi nezha
PoC: GitLab2Safe-Defensive-Checker
100% Defensive Scanner for CVE-2026-110264 GitLab Arbitrary File Write (PHP2Shell) - No exploit code, only version & patch detection for security teams and learners.
PoC: CVE-2026-109618
Use-After-Free on PHP 8.4.26, Apache 2.4.69. RCE pre-auth PoC made for educational purposes
PoC: php2shell-checker
php2shell CVE-2026-109618 CVE-2026-109619 detection tooling for Linux and Windows
PoC: PHP2Shell-MultiScan
PHP2Shell vulnerability scanner for CVE-2026-109618 and CVE-2026-109619. Discover vulnerable PHP version indicators, scan WordPress endpoints, assess security risks, detect exposure signals, and guide PHP patching and remediation.
PoC: php73-backport
PHP 7.3.33-35 (php2shell fix, CVE-2026-109618/109619) rebuilt for Ubuntu 18.04, 20.04 and Debian 10
PoC: php2shell-scan
All-in-one scanner for CVE-2026-109618 / CVE-2026-109619 (php2shell). Domain → subdomain enum → DNS resolve → passive PHP version check.
PoC: php2shell-toolkit
php2shell (CVE-2026-109618/109619) research toolkit - private preview
PoC: php2shell-poc
php2shell rce proof of concept for cve-2026-109618 and cve-2026-109619
PoC: php2shell-check
Find every PHP install vulnerable to PHP2Shell (CVE-2026-109618, CVE-2026-109619) on hosts and container images. Single static binary, backport-aware, defensive only.
PoC: tdoa-php-cve-2026-109618-109619-patch-package
通达OAV11 PHP5.45.0 补丁包
PoC: patch-php2shell
Defensive remediation helper for the PHP2Shell RCE (CVE-2026-109618 / CVE-2026-109619): detects exposure and applies the official fix, with a source-build drop-in for end-of-life PHP 7.4/8.0/8.1.
PoC: php_sec_patch
CVE-2026-109618 and CVE-2026-109619 mitigation
PoC: php2shell-sentinel
PHP2Shell Sentinel is an intelligent, zero-dependency, low-resource cross-platform defense daemon to detect, log, prevent, and actively mitigate php2shell exploits (CVE-2026-109618 & CVE-2026-109619, plus CVE-2024-4577) on both Linux and Windows servers
PoC: php2shell-detector
Passive, evidence-first Chrome extension for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) exposure assessment
PoC: CVE-2022-24707
POC for CVE-2022-24707, an authenticated SQL injection in Anuko Time Tracker’s Puncher plugin before 1.20.0.5642, caused by an unsanitized date POST parameter. It allows UNION-based and time-based blind SQL injection, enabling a logged-in user to dump the database
PoC: php2shell-scanner
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) exposure scanner - flags unpatched PHP version pins across composer/Docker/CI plus attack-surface amplifiers
PoC: self-check
Free read-only self-check scripts for PHP2Shell (CVE-2026-109618), the LiteLLM 1.107.0 compromise and the eMudhra CA keys. Runs on your machine; nothing leaves your network.
PoC: brotli-distro-check
Audit Linux hosts for CVE-2026-111497 vulnerable brotli (1.0.3-1.2.0, CVSS 4.0 9.2). dpkg/apk/rpm/Node aware. Verified across live containers.
PoC: CVE-2026-112403
CVE-2026-112403: Pillow heap buffer overflow in ImagingJpegDecode via lossless JPEG thumbnail. One POST, 100% crash rate.
PoC: php2shell-php7-mitigation-kit
PHP2Shell RCE (CVE-2026-109618 & CVE-2026-109619) defense kit for EOL PHP 7.0–7.4: runtime hardening, Apache/.user.ini/Nginx virtual patches, and diagnostic scanner.
PoC: driver-mapper
manual driver mapper that abuses ThrottleStop.sys (CVE-2025-7771) for physical r/w. pdb symbols, pfn va->pa map, NtAddAtom trampoline, calls DriverEntry.
PoC: el8-php73-security
Patched PHP 7.3 RPMs for EL8 / Rocky Linux 8 (Remi php73-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an installer that detects the server's PHP, upgrades it and can roll back.
PoC: Am-I-Infected
A defensive incident-response scanner for the PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619). am-i-infected answers one question: does this server show signs that PHP2Shell was used against it?
PoC: CVE-2026-109619
PHP2Shell
PoC: CVE-2026-31431
Copy Fail exploit for Ubuntu 20.04 with legacy Python versions, including script to hide Copy Fail.
PoC: php2shell-scanner
Check PHP2Shell (CVE-2026-109618, CVE-2026-109619) from inside your server: distribution backports, missed restarts and interim mitigations, verdicts computed in the browser.
PoC: php2shell-audit
Safe, passive PHP2Shell (CVE-2026-109618/109619) exposure checker with CLI + web UI. Published by LsCom CSIRT.
PoC: ipeh
Aplikasi yang berguna untuk mengecek versi PHP dan apakah versi yang lu Pake, kena CVE-2026-109618 & CVE-2026-109619
PoC: CVE-2026-94300
CVE-2026-94300: This analysis and PoC were produced substantially with AI assistance ("AI patchwork"). Every code, diff and measurement claim should be verified against the cited sources before being relied upon.
PoC: PHP2shell
Nightmare begins / CVE-2026-109518 / CVE-109619/ CVE-2026-109613 ERP Next
PoC: windows-php7-security-backports-for-PHP2Shell
php7-security-backports-for-PHP2Shell，(CVE-2026-109618 、 CVE-2026-109619)
PoC: javafix
Check and fix Java runtimes for CVE-2026-91403 (compromised eMudhra intermediates) on Windows and macOS — consent-first, no dependencies, no network.
PoC: php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
PoC: cve-2019-2215-skyworth
Temproot for Skyworth 65G60 / Coocaa 9S60 (Android 8.0, kernel 4.9.44) via CVE-2019-2215 - port notes for the archived Bravia PoC
PoC: tools
Admin- und Security-Hilfsskripte · u.a. PHP-Patch-Check für PHP2Shell (CVE-2026-109618/109619)
PoC: CVE-2026-109618
CVE-2026-109618 docker本地复现环境+Poc
PoC: php2shell-fix-toolkit
🚨 Emergency toolkit for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) CVSS 9.2 - Unauthenticated RCE in PHP Core. Scanner + Temporary Mitigation + Permanent Fix Guide. Fixed: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12
PoC: CVE-2026-43499-OPPO-A5-PBBT30
在 AI 帮助下利用 ghostlock 提权 oppo a5 pbbt30 至 root
PoC: PHP2Shell-Scanner
PHP2Shell vulnerability scanner for CVE-2026-109618 and CVE-2026-109619. Discover vulnerable PHP version indicators, scan WordPress endpoints, assess security risks, detect exposure signals, and guide PHP patching and remediation.
PoC: gitlab-patch-check
Check whether your self-hosted GitLab version is patched against CVE-2026-110264 (CVSS 10.0 RCE) — companion script for The Homelab Fixer guide.
PoC: CVE-2026-109618-php2shell-lab
PHP 8.4.4 Use-After-Free CVE-2026-109618 lab — tested against a real PHP app with mitigation applied
PoC: php2shell
Two PHP session CVEs (CVE-2026-109618, CVE-2026-109619) — reproducible exploits: pure-HTTP ASLR bypass and unserialize-to-RCE
PoC: CVE-2026-109618
php2shell
PoC: erratumcheck
NS2JB-CVE-2025-10263 erratum check
PoC: PHP-5.6.40-Patched
Patch แบบย่อสำหรับ CVE-2026-109618 และ CVE-2026-109619 เพื่อต่อเวลาไปยังการ Upgrade เป็น PHP รุ่นใหม่กว่า
PoC: php-legacy-cve-2026-109618
Unofficial backports of PHP CVE-2026-109618/109619 (OOM RCE) for legacy PHP 5.4, 5.5 and 7.2 + Apache/FPM mitigations
PoC: gitlab-firing-range
Authorized loopback-only Docker firing range for CVE-2026-110264 (Onigmo regex integer-overflow, unauth RCE) research + detection engineering
PoC: php-el7-cve-2026-109618
CentOS 7 Remi PHP 7.4/8.3 rebuild for CVE-2026-109618/109619
PoC: php2shell
PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance for authorized security testing.
PoC: php2shell-security-assessor
Offline, evidence-aware PHP inventory triage for CVE-2026-109618/109619, with backport handling and static reports.
PoC: CVE2026
This is made for php2shell-CVE-2026-109618-CVE-2026-109619-PoC.
PoC: docker-library-php
docker-library/php with PHP2Shell (CVE-2026-109618/109619) patched 7.4 and 8.1 buster images
PoC: cve-2026-109618-109619-el7
PHP2Shell patches for PHP 7.0.33 on CentOS 7 (Remi RPMs)
PoC: cve-2026-71362-magento-ato
CVE-2026-71362 — Magento Session Identity Poisoning → Mass Account Takeover (CVSS 9.1, CISA KEV)
PoC: CVE-2026-109619
CVE-2026-109619 docker本地复现环境+Poc
PoC: php71-debian9-backport
PHP 7.1 security backport for Debian 9 (stretch / buster 2018) fixing CVE-2026-109618 & CVE-2026-109619
PoC: php2shell-triage
PHP2Shell (CVE-2026-109618/109619) defensive triage & response toolkit: Linux/Unix/Windows/containers, host-specific patch plans, virtual patches, Korean runbook
PoC: php2shell-shield
Risk-reduction WordPress plugin for the PHP2Shell exploit (CVE-2026-109618 / CVE-2026-109619) on sites that cannot update PHP yet. A shield, not a cure.
PoC: php2shell-repro
CVE-2026-109618 / CVE-2026-109619 本地复现笔记：UAF 原语验证、利用链边界分析、加固方案
PoC: guard-for-php74
Guard for PHP 7.4: native Linux package remediation for CVE-2026-109618/109619, with verified build recipes and deployment checks.
PoC: php-safepatch
Find and fix PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Linux, Windows and Docker without changing the PHP minor version. Same-branch patching, admin-locked mitigations, automatic rollback.
PoC: cve-2026-76504-nuclei
Nuclei template for CVE-2026-76504 — Cisco vManage authentication bypass
PoC: php2shell
scanner CVE-2026-109618/CVE-2026-109619. write with bun
PoC: PHP2ShellX-
Script que detecta si tu versión de PHP es vulnerable a PHP2Shell (CVE-2026-109618 / 109619)
PoC: multer-CVE-2026-113872
Write-up and proof of concept for CVE-2026-113872: multer async fileFilter process crash (DoS)
PoC: CVE-2026-109715
CVE-2026-109715
PoC: php2shell-scan
Defensive exposure and IOC scanner for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). No exploit traffic.
PoC: cve-2026-93687-braces
Independent, measured check of CVE-2026-93687 (braces stack exhaustion): reproducible cold-process crash under the default 10000 maxLength, and what actually mitigates it.
PoC: php2shell-guide
PHP2Shell(CVE-2026-109618/109619) 원리와 PHP 버전별 대응을 택배 창고 비유로 설명하는 교육용 페이지
PoC: node-hostcheck
Read-only Node.js check for the Oct 2026 security release (CVE-2026-111497 Brotli RCE + 9). Finds every install (nvm, fnm, volta, system), what each running process actually uses, restarts needed, and eMudhra CA issues.
PoC: php2shell-guard
Cross-platform PHP2Shell (CVE-2026-109618 / CVE-2026-109619) scanner/fixer/verifier — scan, mitigate, upgrade, verify. Zero-dependency Python.
PoC: log4shell-audit-evidence
Evidence trail for the Log4Shell (CVE-2021-44228) follow-up audit
PoC: php2shell-source-hotfix
Emergency PHP2Shell hotfix (CVE-2026-109618 / CVE-2026-109619): apt if possible, else build fixed PHP from source
PoC: php2shell-audit
Free Bash script to check servers, SSH hosts and Docker containers for the PHP2Shell RCE flaws (CVE-2026-109618 & CVE-2026-109619). Read-only. Flags PATCHED, VULNERABLE or unsupported PHP versions.
PoC: CVE-2026-109255
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients.
PoC: nmap-php2shell
Safe Nmap NSE detection for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) using PHP version fingerprinting. No exploitation or intrusive probing.
PoC: lankahost-php-patch-check
Check whether a website’s PHP is patched against CVE-2026-109618 / CVE-2026-109619. Works on cPanel ea-php and CloudLinux alt-php without root access
PoC: go-gitlab-cve-2026-110264-scanner
Fast, concurrent and non-intrusive exposure auditor in Go for GitLab CE/EE unauthenticated RCE (CVE-2026-110264 - CVSS 10.0)
PoC: nilepatch-coraza-bypass
Go app using Coraza WAF (CVE-2026-114101 bypass)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free