Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()

PoC: node2shell-scanner

High fidelity detection mechanism for node2shell (CVE-2026-111497)

PoC: CVE-2026-111497-Toolkit

CVE-2026-111497 – Node.js Brotli Decoder OOB Write (CVSS 9.2) | Red/Blue Team suite for unpatched Node.js 22.x, 24.x, 26.x. 2 tools: Full Exploit (patch detection, remote DoS, Brotli bomb, lab RCE), Blue Team Checker (errno differential, version fingerprint, WAF detection, reporting) Only Use Ethically Only <3

PoC: php2shell

exploit php2shell (CVE-2026-109618 / CVE-2026-109619) for educational purposes

PoC: HTTP2Shell-PoC

PoC for CVE-2026-111497 (HTTP2Shell)

PoC: cve-2024-10441-synology-rce

Writeup y PoC educativo de CVE-2024-10441 (RCE pre-auth como root en Synology DSM via synoplugind). CVE ya parcheado; uso autorizado/defensivo.

PoC: php2shell-migration

Agent Skills skill to detect, patch and verify PHP apps affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619) or outdated PHP. Works with Claude Code, Codex, Copilot, Cursor, Gemini CLI, OpenCode.

PoC: php2shell

CVE-2026-109618 exploit tool — RCE via OOM ghost bucket in PHP POST parsing (CVSS 9.2)

PoC: CVE-2026-114509

Python detector for Laravel TokenGuard CVE-2026-114509 with local dependency analysis, remote authentication checks, and JSON reporting.

PoC: CVE-2026-110264

Non-invasive Python detector for CVE-2026-110264 in GitLab, featuring version checks, offline log analysis, and JSON reporting.

PoC: php-pins

Find every PHP version your repositories pin, and what PHP2Shell (CVE-2026-109618, CVE-2026-109619) means for each. One POSIX sh script; reads files only.

PoC: php2shell

PHP Runtime Vulnerability Assessment Toolkit — CVE-2026-109618 & CVE-2026-109619

PoC: php2shell-demo

🛡️ Hands-on defensive Docker lab for the October 2026 RCE week — PHP2Shell (CVE-2026-109618/619), Node.js Brotli & Next.js sharp. See the attack surface and blast radius, and learn to shut them down. No exploits.

PoC: CVE-2026-115560

CVE-2026-115560: PHP session upload-progress serialize_handler mismatch → pre-auth object injection → RCE. Check/exploit/verify scripts + Docker lab + Suricata/Sigma detection rules.

PoC: CVE-2026-86426

CVE-2026-86426 CHECK

PoC: php-radar

Detection-only exposure scanner for PHP2Shell (CVE-2026-109618/109619): finds PHP across repositories, hosts, a network perimeter, and AWS, and grades each install by version and config without triggering the bug.

PoC: spip-cve-2026

PoC for CVE-2026-72708 (blind SQLi) and CVE-2026-109378 (SSRF) in SPIP, both fixed in 4.4.18

PoC: php2shell

PHP2Shell: finding and patching affected PHP CVE-2026-109618 and CVE-2026-109619

PoC: php2shell-audit

Exposure scanner, patch verifier and threat hunter for CVE-2026-109618/9, with a cyberpunk TUI.

PoC: DFRoot

Fork of datfooldive/DFRoot (DirtyFrag CVE-2026-43284, ReSukiSU) + GitHub Actions APK build

PoC: php8-cve-109618-109619-fix

php:8.0.30-fpm-alpine + official PHP patch for CVE-2026-109618/109619

PoC: brotli-secfix

Security backport toolkit for CVE-2026-111497 on Ubuntu 24.04, featuring upstream patch verification, custom Debian package builds, and offline remediation procedures.

PoC: CVE-2026-88009-PoC

CVE-2026-88009 — Traefik forwards a rootless opaque request target that routing/forwardAuth see as '/'. Auth bypass + access-log evasion, verified v3.7.10 / v3.7.13.

PoC: CVE-2026-85595-PoC

CVE-2026-85595 — Traefik digestAuth authentication bypass (unknown username => empty HA1). Lab-verified: v3.7.10 bypass, v3.7.11 401.

PoC: CVE-2026-85168-PoC

CVE-2026-85168 — n8n Git node RCE from repo-local filter.*.clean / merge-driver config on add|commit|checkout. Verified v2.35.3 / v2.36.2.

PoC: CVE-2026-86076-PoC

CVE-2026-86076 — n8n expression sandbox escape via class-field __sanitize rebinding (backend RCE). Verified v2.37.6 (uid=node) / v2.37.7.

PoC: CVE-2026-109618-CVE-2026-109619-php2shell-

MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.

PoC: CVE-2026-111497-node2shell

CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)

PoC: CVE-2026-56190-Windows-Server-2022-RDP

Unauthenticated RDP vulnerability in termsrv.dll (Windows Server 2022). Proof of Concept for heap spray, XFG bypass, Instruction Pointer control, and reliable Denial of Service (Event ID 7031).

PoC: cve-2026-111497-rce-checker

Lab-only exact-profile RCE/DoS validator for CVE-2026-111497; refuses non-loopback targets

PoC: php2shell-probe

Standalone detection probe for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): passive version fingerprint by default, opt-in active crash probe via Nuclei.

PoC: portainer-cve-2026-44848-checker

Non-destructive checker for CVE-2026-44848: Portainer missing authorization on Docker plugin endpoints

PoC: php2shell

Check and patch all installed PHP versions against PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Debian/Ubuntu with PHP from Surý (HestiaCP supported)

PoC: CVE-2026-38526-Exploit

my version of an exploit for Krayin CRM v2.2.x - CVE-2026-38526

PoC: cve-2026-114820-java-scan

Read-only Ansible playbook that finds Java truststores still anchoring the eMudhra and AAA roots removed for CVE-2026-114820.

PoC: php-5.4-cve-2026-php2shell-patch

Patch for old php 5.4.23 version from CVE-2026-109618 и CVE-2026-109619 vulnerabilities

PoC: CVE-2026-116012

NSA Ghidra contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc.

PoC: CVE-2026-116011

A remote denial of service vulnerability in CrowCPP due to uncontrolled recursion.

PoC: project2026_20261024_php2shellcheck

One-file PHP check for the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619). No exploit, no network.

PoC: CVE-2026-109618-POC

A PHP app that ships an unpatched PHP runtime (PHP2Shell), for the Devzy scan to flag. No exploit code.

PoC: rootkit

越狱助手 · RootKit for Honor Magic9 (CVE-2026-64560 → cred 写 → 自制内核模块 → KernelSU)，Flutter + Shizuku 一键 root

PoC: php2shell-scan-revamp

A clean, modular, and extensively documented reimplementation of the Assetnote php2shell scanner for detecting CVE-2026-109618 and CVE-2026-109619 in PHP environments.

PoC: php2shell-detection-engineering-lab

Production-grade detection engineering suite (Sigma rules & Wazuh XML) and DFIR triage scripts for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).

PoC: CVE-2026-98260-BRM-AN00

CVE-2026-98260 temporary root for HONOR Win2 BRM-AN00, handed to BakaSU. No flashing.

PoC: patchferry-check

Free read-only scripts to check servers for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and PHP end-of-life versions

PoC: php2shell-php

Detect php2shell (CVE-2026-109618 / CVE-2026-109619) on remote PHP targets — behavioral multipart probes, version fallback, async CLI in PHP.

PoC: php2shell-el7-el8-rpm-fixed

Unofficial patched PHP RPMs for EL7/EL8 mitigating php2shell (CVE-2026-109618, CVE-2026-109619), including legacy Remi SCL and AppStream builds.

PoC: cve-2026-110152-chrome-ngle-rce-poc

PoC: CVE-2026-110152 Chrome ANGLE vertex-attribute translation heap buffer overflow (CVSS 9.6)

PoC: cve-2026-109618-php2shell-poc

CVE-2026-109618 (php2shell part 1): local deterministic memory-safety PoC

PoC: php2shel

This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619. PHP is a widely used open-source server-side scripting language, so these vulnerabilities may affect a broad range of internet-facing web applications and products that embed or depend on PHP.

PoC: docker-php74-trixie

Docker Image php:7.4-fpm with security fixes for CVE-2026-109618 and CVE-2026-109619 updated to build and run on Debian Trixie

PoC: CVE-2024-45490-libexpat-poc

PoC + Docker test harness for CVE-2024-45490 (libexpat XML_ParseBuffer negative length integer handling issue)

PoC: log4shell-audit-3

Log4Shell (CVE-2021-44228) remediation tracking for the quarterly security briefing

PoC: RHYTHM-SINGH

High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)

PoC: php2shell-detection

Detection and response package for php2shell (CVE-2026-109618 / CVE-2026-109619): Suricata, Zeek, YARA, Sigma, ModSecurity rules, hunting queries, SOC triage, patch matrix. No exploit code.

PoC: el7-php71-security

Patched PHP 7.1 RPMs for CentOS 7 (Remi php-* and php71-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an installer that detects the server's PHP, upgrades it and can roll back.

PoC: php2shell-check

Check if your server is vulnerable for latest PHP2Shell (CVE-2026-109618,CVE-2026-109619, CVE-2026-115560)

PoC: php2shell-2026

Published indicators and a log-hunting guide for the PHP2Shell PHP flaws (CVE-2026-109618, CVE-2026-109619)

PoC: php2shell-repro

PHP2Shell CVE-2026-109618/109619: lab-verified reproduction, root-cause analysis & visualizations (educational)

PoC: php2shell-claude-code-prompt

Prompt para corrigir o PHP2Shell (CVE-2026-109618 e CVE-2026-109619) com o Claude Code, aprovando cada passo. Português e inglês.

PoC: poc-cve-2026-111497

CVE-2026-111497 (Node2Shell): deteccion del decoder Brotli vulnerable en Python y Node por el codigo de error real del decoder, con laboratorio HTTP local

PoC: cve-2026-114509-laravel-tokenguard

CVE-2026-114509 — Laravel TokenGuard authentication bypass (CVSS 9.2): PoC, root-cause analysis, Docker lab, and reproduction guide

PoC: node2shell-cve-2026-111497

Node2Shell / HTTP2Shell (CVE-2026-111497) exposure-audit kit — read-only scanner + agent prompt pack. Portable: macOS bash 3.2 + Linux. 78-test suite, CI on 3 platforms.

PoC: node2shell-radar

Find Node.js websites and see which ones need attention. Desktop Node2Shell Scanner for CVE-2026-111497.

PoC: chrome2shell

Chrome Vulnerability Laboratory . CVE-2026-110922

PoC: node2shell

Independent reproduction of the Brotli decoder out-of-bounds write behind CVE-2026-111497 (Node2Shell): payload built from first principles, A/B against the patched release, and a measured ceiling that rules out the advertised RCE path.

PoC: php2shell-runcloud-builds

Unofficial patched PHP 5.6-8.1 builds for RunCloud on Ubuntu 16.04-24.04 (PHP2Shell, CVE-2026-109618/109619), with scripts to build them yourself

PoC: honor-aap-an00-root-skill

Reproducible temporary root for Honor 500 AAP-AN00 (CVE-2026-43499, source, prebuilt payload, guides and evidence)

PoC: PHP-CVE-Scanner

Harmless fingerprint scanner for PHP CVE-2026-109618 / CVE-2026-109619 (CLI + Web UI)

PoC: CVE-2026-59774

Gitea LFI to RCE exploit (CVE-2026-59774) — arbitrary file read via Org-mode #+INCLUDE, chained to remote code execution through git hook injection

PoC: CVE-2026-115560

PoC and Docker lab for CVE-2026-115560 — PHP session upload-progress serialize_handler mismatch to unauthenticated object injection / RCE. Validated end-to-end on php:8.4.27-apache with mitigation and no-switch controls.

PoC: CVE-2026-110264

PoC, reproducible labs, live evidence, Nuclei fingerprint, and technical report for CVE-2026-110264 — GitLab Org-mode/Onigmo unauthenticated RCE (CVSS 10.0); render oracle validated on GitLab CE 19.3.1.

PoC: CVE-2026-111497

PoC, Docker lab, and technical report for CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder invalid block-switch OOB write; validated errno differential and weaponized remote DoS, RCE analysis included.

PoC: GHSA-w8hw-w9fx-j79w

PHP2Shell PoC for GHSA-w8hw-w9fx-j79w / CVE-2026-109618 — PHP OOM longjmp memory corruption. Validated OOM producers and dangling session-state worker crash on PHP 8.4.26 mod_php, with instrumented lab and full report.

PoC: php2shell-kit

Single-command wrapper for the php2shell toolkit (CVE-2026-109618 / CVE-2026-109619) - auto version detection, profile dispatch, Docker lab

PoC: CVE-2026-39987-POC-Marimo

CVE-2026-39987 POC Marimo

PoC: php2shell-poc

CVE-2026-109618 & CVE-2026-109619 — PHP Pre-Auth RCE Exploit & Detection Toolkit

PoC: php-stale-global-uaf

PHP 8.5.11 - Critical - Remote - UAF - CVE-2026-109619 PHP2Shell. Same-worker fatal backtrace then INI diagnostic on Apache mod_php. Lab vs 8.5.12. Advisory RCE inferred.

PoC: php-oom-longjmp

PHP 8.4.26 - Critical - Remote - OOM longjmp - CVE-2026-109618 PHP2Shell. Unauth chunked multipart hits memory_limit before app code on Apache mod_php. Lab vs 8.4.27. Advisory RCE inferred.

PoC: php2shell

Desktop tool to find, audit, and remediate the PHP2Shell CVEs (CVE-2026-109618/109619) on your own infrastructure — network scan, SSH/SFTP checks, guided upgrades, and log analysis.

PoC: CVE-2026-111497-assessment

Defensive assessment toolkit for CVE-2026-111497 (Brotli OOB write): ecosystem scanner, Python outbound PoC, canary server, CDN amplification analysis, framework defense matrix

PoC: plex2shell-check

Quick Plex2Shell (CVE-2026-96652) exposure & version check — is your Plex Media Server patched (1.43.3.10861+)?

PoC: cve-2026-109619

CVE-2026-109619 PoC lab

PoC: lotstamp

Reads the Brotli decoder inside every Node, Bun, Electron app and AI coding tool on your machine: which still carry CVE-2026-111497. Executes nothing.

PoC: CVE-2026-109618-109619-Docker-Lab-Tutorial

Lab pembelajaran lokal untuk mereproduksi CVE-2026-109618/109619 pada Docker.

PoC: CVE-2026-115560

CVE-2026-115560: PHP session upload progress mitigation

PoC: CVE-2026-114509

Reproducible local Laravel lab and self-checking PoC for CVE-2026-114509

PoC: brotli-patch

Node.js (14 e 20, em fim de vida) com o decoder Brotli corrigido: CVE-2026-111497 (Node2Shell). Não oficial.

PoC: CVE-2026-102785

CVE-2026-102785 YOOtheme Pro 5.0.0-5.0.52 │ Unauthenticated RCE Mass Exploit & WAF Bypass

PoC: docker-hub-pat-check

Standalone defensive checker project for CVE-2026-105445: Docker Hub account-conversion PAT reassignment. One exploit per repository; implementation pending.

PoC: copyescape-check

Standalone defensive checker project for CVE-2026-17106: Docker copy destination escape. One exploit per repository; implementation pending.

PoC: node-cve-2026-106073-check

Standalone defensive checker project for CVE-2026-106073: Node.js: Permission Model realpathSync read bypass. One exploit per repository; implementation pending.

PoC: node-cve-2026-106071-check

Standalone defensive checker project for CVE-2026-106071: Node.js: Permission Model wildcard path over-grant. One exploit per repository; implementation pending.

PoC: node-cve-2026-106070-check

Standalone defensive checker project for CVE-2026-106070: Node.js: ZipFile invalid-header content substitution. One exploit per repository; implementation pending.

PoC: node-cve-2026-106074-check

Standalone defensive checker project for CVE-2026-106074: Node.js: Crypto entropy cache duplication in snapshots. One exploit per repository; implementation pending.

PoC: node-cve-2026-106072-check

Standalone defensive checker project for CVE-2026-106072: Node.js: TLS noncanonical-IP DNS SAN acceptance. One exploit per repository; implementation pending.

PoC: node-cve-2026-105481-check

Standalone defensive checker project for CVE-2026-105481: Node.js: HTTP keep-alive premature-response acceptance. One exploit per repository; implementation pending.

PoC: node-cve-2026-106069-check

Standalone defensive checker project for CVE-2026-106069: Node.js: TLS leading-zero IPv4 resolver mismatch. One exploit per repository; implementation pending.

PoC: node-cve-2026-105483-check

Standalone defensive checker project for CVE-2026-105483: Node.js: TLS fullwidth-IP hostname validation bypass. One exploit per repository; implementation pending.

PoC: node-cve-2026-105482-check

Standalone defensive checker project for CVE-2026-105482: Node.js: DNS resolution NUL-name truncation. One exploit per repository; implementation pending.

PoC: node-cve-2026-58044-check

Standalone defensive checker project for CVE-2026-58044: Node.js HTTP header-limit request smuggling. One exploit per repository; implementation pending.