## Summary The Fortran extractor's C-preprocessor step (`graphify/extractors/fortran.py`, `_cpp_preprocess`) applies an incomplete `#include` hardening. The `-nostdinc -I /dev/null` flags it relies on (comment "Security (F-007)") do **not** stop a capital-`F` Fortran source file from including **absolute paths** (`#include "/etc/passwd"`) or from **path-traversing out of the corpus** (`#include "../../../../home/victim/.ssh/id_rsa"`). `cpp` always searches the directory of the file being preprocessed for quoted includes and always honours absolute include paths, regardless of `-nostdinc`/`-I`. As a result, indexing an untrusted repository that contains a `.F`/`.F90`/`.F95`/`.F03`/`.F08` file reads arbitrary local files off the host and inlines their contents into the knowledge graph, which is then shipped to the LLM/agent and written to the on-disk, shareable output (`graph.json`, `GRAPH_REPORT.md`, the Obsidian wiki, HTML/SVG exports). This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. ## Severity High. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path (`graphify update .` / `graphify extract`) — no credentials, network, or LLM call required. CWE-73 (external control of file name/path) / CWE-22 (path traversal) / CWE-200 (information exposure). ## Where `graphify/extractors/fortran.py`, `_cpp_preprocess()`: result = subprocess.run( ["cpp", "-w", "-P", "-nostdinc", "-I", "/dev/null", str(path.resolve())], capture_output=True, timeout=30, ) Reached from `extract_fortran()` (same file) for any suffix in `_FORTRAN_CPP_EXTS = {".F", ".F90", ".F95", ".F03", ".F08"}`, which are collected by default (`detect.CODE_EXTENSIONS`) and dispatched by `extract._DISPATCH`. ## Why the mitigation does not work `-nostdinc` only removes the standard *system* include directories, and `-I /dev/null` only sets the *additional* search path. Neither affects: 1. Absolute includes — `#include "/etc/passwd"` is opened directly by cpp. 2. Quoted includes relative to the current file — cpp always searches the directory containing the file being preprocessed for `#include "..."`, so `#include "../../../../etc/shadow"` traverses out of the corpus. ## Proof of concept (verified) Reproduced against the shipped code with the exact command `_cpp_preprocess` builds (`cpp -w -P -nostdinc -I /dev/null <file>`), and against `extract_fortran()` directly. Secret on disk (`/tmp/secret.txt`): `TOP_SECRET_...` (a) Absolute include — `evil_abs.F90`: program evil #include "/absolute/path/to/secret.txt" end program evil (b) Relative traversal — `evil_rel.F90`: program evil #include "../secret.txt" end program evil Both produce preprocessed output containing the full secret file contents (`"SECRET IN OUTPUT: True"` for both). Surfacing into the graph — `leak.F90` places the include in an identifier position via a free-form continuation so the leaked value becomes a node/edge: module m contains subroutine s use & #include "/path/to/token.secret" end subroutine s end module m `extract_fortran()` on this file emits a node whose label is the entire single-line contents of `token.secret` and an `imports` edge to it. That node is written to `graph.json` / `GRAPH_REPORT.md` / the wiki and returned by the MCP `query_graph` / `get_node` / `get_neighbors` tools — i.e. exfiltrated into the agent's context and into persisted, shareable artifacts. Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires `cpp`/gcc on PATH (near-ubiquitous on the dev/CI hosts graphify targets); it cleanly falls back to raw bytes when absent. ## Suggested fix Mirror the containment approach already used elsewhere in the codebase (`_project_xml_is_safe`, `security.validate_graph_path`): before invoking cpp, scan the source for `#include` directives and **refuse or neutralise any include whose target is absolute or resolves outside the corpus/repo root**. Concretely, in `_cpp_preprocess`: - Parse `#include "..."` / `#include <...>` directives. - Resolve each target against the file's directory; if it is absolute, or its `.resolve()` escapes the scan root, strip that line (or fall back to `path.read_bytes()` with no preprocessing). - Only allow includes that resolve to a path inside the corpus root. A blunter but safe alternative is to strip all `#include` lines before preprocessing (macros still expand; cross-file includes lose fidelity but no host files can be read). Running cpp inside a filesystem sandbox (bwrap/unshare with only the corpus mounted) would also close it but is heavier. ## Detected by Aeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical `cpp` repro confirmed the bypass.
PoC: node2shell-scanner
High fidelity detection mechanism for node2shell (CVE-2026-111497)
PoC: http2shell-CVE-2026-111497
PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosure, DoS, or RCE when processing crafted compressed data.
PoC: runcloud-php2shell-patch
Build script for PHP (7.2 - 8.1) binaries mitigating PHP2Shell (CVE-2026-109618, CVE-2026-109619) on RunCloud Ubuntu servers.
PoC: php2shell-scan
A deliberately limited, read-only security scanner for assessing exposure to CVE-2026-109618 (RFC 1867 multipart OOM memory corruption) and CVE-2026-109619 (stale global state use-after-free) in PHP deployments.
PoC: CVE-2026-98260-OnePlus16-PYB110-Jailbreak
CVE-2026-98260 (exec: posix CPU timer UAF) - one-command temporary root for OnePlus 16 (PYB110) from uid 2000 shell, with KernelSU/FinaSU handover
PoC: php2shell-wordpress-rce-fullchain
Pre-auth RCE against WordPress (7.1.2/7.1.3) via PHP2Shell CVE-2026-109618 / CVE-2026-109619
PoC: php2shell-scanner
Audit & Vulnerability Detection Scanner for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) with Hardening Guidelines
PoC: php2shell-wordpress-check
A read-only Site Health check that compares the PHP version your site is running with the releases that fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
PoC: CVE-2026-111497
Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready reports.
PoC: AI-Threat-Detection-PHP-CGI-Vulnerabilities
A curated, deep-dive guide to leveraging Artificial Intelligence, Machine Learning, and Large Language Models (LLMs) to detect, analyze, and neutralize advanced web application threats—with a specific focus on recent, critical PHP CGI Argument Injection vulnerabilities (such as CVE-2024-4577) and similar Remote Code Execution (RCE) breaches.
PoC: php2shell-doctor
The safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619). Local, offline, vendor-backport aware.
PoC: node2shell-lab
Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-calibrated. Part of the *2Shell lab series. EN/中文/日本語.
PoC: php2shell-ioc
Curated IoCs, detection engineering rules, and automated threat intel feeds for PHP2Shell (CVE-2026-109618 & CVE-2026-109619).
PoC: php2shell-toolkit
CVE-2026-109618 PHP session.upload_progress detection & authorized testing toolkit
PoC: HTTP2Shell-PoC
PoC for CVE-2026-111497 (HTTP2Shell)
PoC: cve-2024-10441-synology-rce
Writeup y PoC educativo de CVE-2024-10441 (RCE pre-auth como root en Synology DSM via synoplugind). CVE ya parcheado; uso autorizado/defensivo.
PoC: php2shell-migration
Agent Skills skill to detect, patch and verify PHP apps affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619) or outdated PHP. Works with Claude Code, Codex, Copilot, Cursor, Gemini CLI, OpenCode.
PoC: php2shell
CVE-2026-109618 exploit tool — RCE via OOM ghost bucket in PHP POST parsing (CVSS 9.2)
PoC: php82-ubuntu2404-backport
PHP 8.2.35 rebuild (CVE-2026-109618 / CVE-2026-109619 fix, no telemetry) for Ubuntu 24.04 hosts running php8.2 8.2.7-1ubuntu1
PoC: CVE-2026-109618-109619-php2shell
CVE-2026-109618-109619 PHP2shell
PoC: php2shellscanner-web
Browser-based terminal-style UI for assetnote's php2shell-scanner (CVE-2026-109618 / CVE-2026-109619), with live per-probe SSE activity log and JSON export. Detection engine by assetnote; original discovery by Calif.
PoC: php2shell-research-public
Reproducible local Docker lab for CVE-2026-109618 PHP-FPM validation
PoC: PHP2shell
PHP2Shell — Unauthenticated RCE chain exploiting CVE-2026-109618 (OOM memory corruption) + CVE-2026-109619 (stale global state) in PHP.
PoC: B63-POC-CVE-2026-20131
CVE-2026-20131 (Cisco FMC): pre-auth Java deserialization to root — VERIFIED-AT-PRIMITIVE showcase artifact (rebuilt twins; appliance not executed, entitlement-gated)
PoC: B63-POC-CVE-2026-75650
CVE-2026-75650 (StyleSmuggler): unauthenticated RCE via template injection in Magento Open Source / Adobe Commerce 2.4.4–2.4.9 — b63 showcase, lab-verified with patched-build negative test
PoC: CVE-2026-98260-pudding-android
Target-specific Android CVE-2026-98260 research port for Xiaomi 17 (pudding)
PoC: node2shell-detector
node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.
PoC: hdu-is-work1
Secure REST API with CI/CD security scanning (Bandit SAST + pip-audit SCA) and a reproducible CVE-2017-1000028 lab (GlassFish 4.1)
PoC: php81-el7-php2shell
Unofficial CentOS 7 (EL7) rebuild of Remi php-8.1.34-6 with the PHP2Shell (CVE-2026-109618, CVE-2026-109619) mitigation
PoC: sl0ppy-riftscan-CVE-2026-42945
riftscan module for metasploit msf for cve CVE-2026-42945
PoC: CVE-2026-84589-macOS-TCC-Bypass
CVE-2026-84589: macOS TCC privacy bypass via FaceTime impersonation. Technical PoC analysis, Apple disclosure timeline, and patch coverage.
PoC: php2shell-fixer
Claude Code plugin: audit and patch PHP2Shell (CVE-2026-109618/109619) on Debian/Ubuntu PHP servers
PoC: PHP-CVE-2026-115560-Cheker-v-1.0
PHP alerta de CVE-2026-115560 PERO SABES SI TUS SISTEMAS SON VULNERABLES? Bueno amigos hice un script que checa si eres vulnerable y te dice exactamente que parámetros modificar para no estar vulnerable pero la buena noticia es que, según el propio proyecto, se trata de un riesgo poco probable en la práctica.
PoC: test-php
Controlled lab pinned to PHP 8.3.35 for reproducing/patch-verifying PHP2Shell (CVE-2026-109618, CVE-2026-109619)
PoC: CVE-2026-109618
CVE-2026-109618 - PHP session.upload_progress Heap UAF Pre-Auth RCE (CVSS 9.2)
PoC: CVE-2026-109619
CVE-2026-109619 - PHP session.upload_progress File Poisoning + LFI RCE (CVSS 9.2)
PoC: http2shell-check
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.
PoC: php2shell-behind-nginx
php2shell (CVE-2026-109618/9) behind nginx: measurements, lab, and an app-LFI chain that survives a proxy
PoC: CVE-2026-116106
CVE-2026-116106 - HeyCyan App 1.0.103 (Android) controle de acesso incorreto no FileProvider (CWE-284) - VulDB VDB-426174
PoC: CVE-2026-116105
CVE-2026-116105 - HeyCyan App 1.0.103 (Android) transmissao em texto claro / cleartext transmission (CWE-319) - VulDB VDB-426173
PoC: C-A-S
C.A.S-Exploit — Python-based security research and proof-of-concept toolkit for CVE-2017-5689 (Intel AMT authentication bypass), featuring Shodan discovery, HTTP/WS-Management testing, batch scanning, and vulnerability logging.
PoC: php2shell-monitor-rz
PHP2Shell Monitor - Real-time detection for CVE-2026-109618/109619 exploitation attempts
PoC: msgpack-CVE-2021-23410-test.hpp
the improve SourceInfo UX around server:
PoC: php2shell-unchained
Isolated Docker adversary-emulation lab: PHP2Shell (CVE-2026-109618/619, CVE-2026-115560) exploit chains, 11-scenario patch & WAF audit, Sliver C2, Cloudflare Quick Tunnel + Tor egress, guided mitigation validation.
PoC: Root-My-Galaxy-Payloads-SM-S928B
SM-S928B / S928BXXU6EZIF port of the CVE-2026-43499 app payload - work in progress, not yet rooted
PoC: CVE-2026-0073
CVE-2026-0073: Android adbd TLS auth bypass PoC. Exploits a logic bug where OpenSSL's EVP_PKEY_cmp() returns -1 on key type mismatch (EC vs RSA), incorrectly evaluating to true and granting access. Includes functional Python and standalone C exploits to gain unauthenticated remote shell on Android devices with Wireless Debugging enabled.
PoC: CVE-2025-26326
CVE-2025-26326 - vulnerabilidade critica em add-ons de conexao remota do NVDA (recuperado)
PoC: CVE-2024-6387-how-to-fix
Guia de correcao e mitigacao da CVE-2024-6387 (regreSSHion / OpenSSH) (recuperado)
PoC: Cloudflare-Exploits-CVE-2026-14440-CVE-2026-3125-CVE-2025-0651
PoC e exploits para CVE-2026-14440 (Universal SSL CAA Bypass), CVE-2026-3125 (OpenNext SSRF), CVE-2025-0651 (WARP Windows Privesc) | By Gh0st-Bx1
PoC: Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619
Bigfix PHP Vulnerability Scanner Content (CVE-2026-109618, CVE-2026-109619) for Windows, Linux and Mac.
PoC: PHP2Shell
A local Docker-based research lab for investigating PHP2Shell (CVE-2026-109618 and CVE-2026-109619), comparing PHP 8.4.26 and 8.4.27, and validating upstream security fixes and regression tests.
PoC: Galaxy-Tab-S10FE-Root
One-command ADB root for Samsung Galaxy Tab S10 FE (SM-X520, X520XXSACZH6): CVE-2026-43499 GhostLock exploit + KernelSU late-load. No bootloader unlock.
PoC: Fortinet-Exploits-CVE-2026-39808-106173-107656
PoC e Exploits completos para CVE-2026-39808 (FortiSandbox RCE), CVE-2026-106173 (FortiSIEM gRPC Path Traversal RCE) e CVE-2026-107656 (FortiSandbox Auth Bypass) - CVSS 9.6-9.8
PoC: bug-free-broccoli
CVE-2026-59248
PoC: php2shell-checker
Check PHP for PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed PHP and Ubuntu/Debian/AlmaLinux packages, plus a read-only version check script.
PoC: http2shell-checker
Check Node.js, Bun, Python Brotli and libbrotli for HTTP2Shell / Node2Shell (CVE-2026-111497): fixed versions and a read-only version check script.
PoC: CVE-2026-109618-109619-checker
CVE-2026-109618 / 109619 checker
PoC: CVE-2026-106781
CVE-2026-106781 CH341SER Driver Installer Privilege Escalation
PoC: CVE-2026-112900-PoC
Proof of Concept (PoC) demonstrating Argument Injection in Pillow's Ghostscript call (Pillow < 13.0.0) potentially leading to arbitrary command execution (RCE).
PoC: Root-My-Galaxy-S4
Root the Samsung Galaxy S4 on official firmware via CVE-2015-1805 & KNOX e-fuse stays intact
PoC: ksu-root
在 REDMI K90 Max（代号 prague / OS4.0.0.14）上，从手机端一键开一个临时 root。利用 CVE-2026-64560（posix-cpu-timers UAF）加载 KernelSU LKM，重启即失效。不需要电脑、不刷机、不解锁 Bootloader。
PoC: CVE-2026-115560
PHP session.upload_progress Enabled - CVE-2026-115560 Precondition
PoC: php2shell
php2shell(CVE-2026-109618 / CVE-2026-109619) EXP
PoC: cve-2026-98260-vivo-gki-research
Research notes: porting CVE-2026-98260 to vivo/iQOO GKI 6.6.127 (no exploit code; coordinated disclosure planned)
PoC: brotli-cve-check
Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes
PoC: php2shellX
Next-generation exploit orchestrator for CVE-2026-109618/619 — adds Cloudflare WAF bypass, flexible target specification (URL/host/port/path/batch), multi-format output (JSON/CSV/table), resume capability, and lab automation (Docker restart). Authored by TESTERXMA.
PoC: a12-ghostlock
One-click root for the Samsung Galaxy A12 (SM-A125F) via CVE-2026-43499 (GhostLock) - KernelSU-compatible userspace stack, grant dialog, verified root in Neo Backup / App Manager / Shizuku
PoC: o3root
Shizuku-driven CVE-2026-98260 root + KernelSU runtime LKM loader for Xiaomi yingtian / lhasa (kernel 6.18.21)
PoC: homebrew-php2shell-doctor
Homebrew tap for php2shell-doctor - the safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619)
PoC: php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free
php:7.4-fpm-CVE-2026-109618-109619-free
PoC: cve-2026-25262-poc
CVE-2026-25262 (Qualcomm BootROM) deep-dive on the Black Hat Asia 2026 'A journey through Sahara' talk + read-only Sahara/EDL recon harness. GPLv3.
PoC: CVE-2026-74580
CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration - Exploit
PoC: php2shell
Патчи безопасности и сканер аудита для FastPanel и Debian PHP против уязвимостей CVE-2026-109618 и CVE-2026-109619 (PHP 5.2–8.1). Пошаговые руководства по сборке.
PoC: log4shell-audit-4
Quarterly security briefing research notes and remediation tracking for Log4Shell (CVE-2021-44228).
PoC: CEV-2020-25213_wp-file-manger_exploit
CVE-2020-25213 - Unauthenticated RCE exploit for WP File Manager plugin (≤ 6.0) | Educational purposes only
PoC: php-vulns-discovered-23-10-2026
Patch temporanee per sistemi con versioni di PHP inferiori a 8.2.35 contro CVE-2026-109618 - CVE-2026-109619 - CVE-2026-115560
PoC: CVE-2026-109618-php56-public
Exact-build PHP 5.6 research and reproducible labs for CVE-2026-109618 and CVE-2026-109619
PoC: Compiled-CVE-2023-21752
Compiled version of Wh04m1001's exploit for iwr/wget delivery to VM.
PoC: CVE-2026-83548
CVE-2026-83548 — SonicWall SMA1000 Work Place pre-auth SSRF
PoC: CVE-2026-64849
CVE-2026-64849 — MLflow SSRF
PoC: CVE-2026-21627
CVE-2026-21627 proof of concept and exploit script
PoC: php8.1-cve-109618-109619-fix
php:8.1.34-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: php7.4-cve-109618-109619-fix
php:7.4.33-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: php2shell
Exploit & analysis for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Demonstrating memory disclosure, ASLR bypass, and RCE via session.upload_progress memory bailout dangling pointers.
PoC: php2shell-demo
🛡️ Hands-on defensive Docker lab for the October 2026 RCE week — PHP2Shell (CVE-2026-109618/619), Node.js Brotli & Next.js sharp. See the attack surface and blast radius, and learn to shut them down. No exploits.
PoC: CVE-2026-115560
CVE-2026-115560: PHP session upload-progress serialize_handler mismatch → pre-auth object injection → RCE. Check/exploit/verify scripts + Docker lab + Suricata/Sigma detection rules.
PoC: CVE-2026-86426
CVE-2026-86426 CHECK
PoC: php-radar
Detection-only exposure scanner for PHP2Shell (CVE-2026-109618/109619): finds PHP across repositories, hosts, a network perimeter, and AWS, and grades each install by version and config without triggering the bug.
PoC: spip-cve-2026
PoC for CVE-2026-72708 (blind SQLi) and CVE-2026-109378 (SSRF) in SPIP, both fixed in 4.4.18
PoC: php2shell
PHP2Shell: finding and patching affected PHP CVE-2026-109618 and CVE-2026-109619
PoC: php2shell-audit
Exposure scanner, patch verifier and threat hunter for CVE-2026-109618/9, with a cyberpunk TUI.
PoC: DFRoot
Fork of datfooldive/DFRoot (DirtyFrag CVE-2026-43284, ReSukiSU) + GitHub Actions APK build
PoC: php8-cve-109618-109619-fix
php:8.0.30-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: brotli-secfix
Security backport toolkit for CVE-2026-111497 on Ubuntu 24.04, featuring upstream patch verification, custom Debian package builds, and offline remediation procedures.
PoC: CVE-2026-88009-PoC
CVE-2026-88009 — Traefik forwards a rootless opaque request target that routing/forwardAuth see as '/'. Auth bypass + access-log evasion, verified v3.7.10 / v3.7.13.
PoC: CVE-2026-85595-PoC
CVE-2026-85595 — Traefik digestAuth authentication bypass (unknown username => empty HA1). Lab-verified: v3.7.10 bypass, v3.7.11 401.
PoC: CVE-2026-85168-PoC
CVE-2026-85168 — n8n Git node RCE from repo-local filter.*.clean / merge-driver config on add|commit|checkout. Verified v2.35.3 / v2.36.2.
PoC: CVE-2026-86076-PoC
CVE-2026-86076 — n8n expression sandbox escape via class-field __sanitize rebinding (backend RCE). Verified v2.37.6 (uid=node) / v2.37.7.
PoC: CVE-2026-109618-CVE-2026-109619-php2shell-
MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.
PoC: CVE-2026-111497-node2shell
CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free