### Summary Coraza fails to inspect URL-encoded form bodies when their valid `Content-Type` contains a media-type parameter, for example: ```http Content-Type: application/x-www-form-urlencoded; charset=UTF-8 ``` An unauthenticated attacker can use this header to hide the complete form body from custom Coraza rules that inspect `ARGS_POST` or `REQUEST_BODY`, while the bundled Go HTTP middleware forwards the body and the backend parses it normally. This is a deterministic request-body inspection bypass. Suggested severity: **Medium**. Current OWASP CRS includes rule `901340`, which forces fallback inspection and mitigates this path; this report does not claim a bypass of an unmodified current CRS ruleset ### Details The affected component is request-body processor selection in [`internal/corazawaf/transaction.go`](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/corazawaf/transaction.go#L371-L390). `Transaction.AddRequestHeader` compares the complete lowercased header value using exact equality: ```go case "content-type": val := strings.ToLower(value) if val == "application/x-www-form-urlencoded" { tx.variables.reqbodyProcessor.Set("URLENCODED") } else if strings.HasPrefix(val, "multipart/form-data") { tx.variables.reqbodyProcessor.Set("MULTIPART") } ``` Source: [`internal/corazawaf/transaction.go`, lines 383-390](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/corazawaf/transaction.go#L383-L390). The media type of `application/x-www-form-urlencoded; charset=UTF-8` remains `application/x-www-form-urlencoded`; `charset` is a parameter. Because Coraza compares the entire header, the comparison fails and `REQBODY_PROCESSOR` remains empty. `ProcessRequestBody` treats the empty processor as success: ```go rbp = strings.ToLower(rbp) if rbp == "" { tx.WAF.Rules.Eval(types.PhaseRequestBody, tx) return tx.interruption, nil } ``` Source: [`internal/corazawaf/transaction.go`, lines 1115-1120](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/corazawaf/transaction.go#L1115-L1120). Coraza therefore evaluates phase 2 without parsing the body and without setting `REQBODY_ERROR`. The [URL-encoded processor that normally populates `ARGS_POST`, `REQUEST_BODY`, and `REQUEST_BODY_LENGTH`](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/internal/bodyprocessors/urlencoded.go#L19-L33) is never invoked. The [bundled middleware buffers and reconstructs the full request body before invoking the backend](https://github.com/corazawaf/coraza/blob/db9850b2dd8992f97a8cefe08d0cb4edd966a04c/http/middleware.go#L69-L97). The backend consequently receives data that was absent from Coraza's body variables. The issue exists in the standard compiled implementation; no special build tag is required. Request-body access defaults to Off in an empty configuration, but Coraza's recommended configuration enables it with `SecRequestBodyAccess On`. ### PoC Save this self-contained test as `parameterized_form_bypass_test.go` in the Coraza repository root: ```go package coraza_test import ( "net/http" "net/http/httptest" "strings" "testing" coraza "github.com/corazawaf/coraza/v3" corazahttp "github.com/corazawaf/coraza/v3/http" ) func TestParameterizedFormInspectionBypass(t *testing.T) { cfg := coraza.NewWAFConfig().WithDirectives(` SecRuleEngine On SecRequestBodyAccess On SecRule ARGS_POST:cmd "@streq evil" "id:910001,phase:2,deny,status:403,t:none" `) waf, err := coraza.NewWAF(cfg) if err != nil { t.Fatal(err) } backendSaw := "" handler := corazahttp.WrapHandler(waf, http.HandlerFunc( func(w http.ResponseWriter, r *http.Request) { if err := r.ParseForm(); err != nil { t.Fatal(err) } backendSaw = r.PostForm.Get("cmd") w.WriteHeader(http.StatusNoContent) }, )) req := httptest.NewRequest( http.MethodPost, "http://example.test/", strings.NewReader("cmd=evil"), ) req.Header.Set( "Content-Type", "application/x-www-form-urlencoded; charset=UTF-8", ) rec := httptest.NewRecorder() handler.ServeHTTP(rec, req) if rec.Code != http.StatusNoContent { t.Fatalf("expected request to reach backend, status=%d", rec.Code) } if backendSaw != "evil" { t.Fatalf("backend did not receive malicious value: %q", backendSaw) } } ``` Run: ```bash go test . -run TestParameterizedFormInspectionBypass -v ``` Observed: ```text === RUN TestParameterizedFormInspectionBypass --- PASS: TestParameterizedFormInspectionBypass (0.00s) PASS ``` The test passes only when Coraza fails to return its configured 403 response and the backend parses `cmd=evil`. As a control, change the header to: ```http Content-Type: application/x-www-form-urlencoded ``` Coraza then selects the URL-encoded processor, exposes `cmd=evil` as `ARGS_POST:cmd`, and returns 403 before the backend runs. ### Impact This is a parser differential and request-body inspection bypass affecting applications protected by custom Coraza rules. An unauthenticated attacker can add `charset=UTF-8` to an ordinary form request. Coraza then runs phase-2 rules without the submitted parameters and reports no body-processing failure, while the application receives and processes those parameters. Rules relying on these variables are affected on this path: - `ARGS_POST` - `ARGS` for POST-derived values - `ARGS_POST_NAMES` - `ARGS_NAMES` - `REQUEST_BODY` - `REQUEST_BODY_LENGTH` This defeats custom rules intended to reject injection strings, dangerous commands, or forbidden business values in form fields. The final application impact depends on the backend behavior that the bypassed rule was intended to protect. Affected operators are those who enable request-body access and rely on automatic URL-encoded parsing without current CRS rule `901340`, `ctl:forceRequestBodyVariable=On`, an explicitly forced processor, or equivalent backend validation. The fix is to parse Content-Type according to MIME syntax and compare the normalized media type without parameters, for example with Go's `mime.ParseMediaType`. If an expected body has no processor, Coraza should expose an explicit processing error instead of silently evaluating phase 2 with empty variables. ## Follow-up (2026-09-30): duplicate Content-Type headers desynchronize processor selection from the parsed body The original fix made body-processor selection tolerant of media-type parameters (`charset=UTF-8` etc.) by switching from exact equality to `strings.HasPrefix`. A second, distinct gap was found while reviewing that same selection code: it never accounted for a request carrying *more than one* `Content-Type` header. ### Root cause `Transaction.AddRequestHeader` is called once per header by the integrator (documented contract). Its `content-type` case runs on every call: ```go case "content-type": val := strings.ToLower(value) if strings.HasPrefix(val, "application/x-www-form-urlencoded") { tx.variables.reqbodyProcessor.Set("URLENCODED") } else if strings.HasPrefix(val, "multipart/form-data") { tx.variables.reqbodyProcessor.Set("MULTIPART") } ``` A request with two `Content-Type` headers therefore has its body-processor selection silently overwritten by the *last* one, since each call unconditionally calls `Set`. Meanwhile, `ProcessRequestBody` extracts the `mimeType` it passes to whichever processor gets selected from `requestHeaders.Get("content-type")[0]` -- the *first* value (`internal/corazawaf/transaction.go`, a few hundred lines below `AddRequestHeader`) -- and Go's `net/http` `Header.Get` (what a typical backend uses) also returns only the first value. So selection follows the last header while everything else follows the first, and the two can disagree entirely. ### PoC ```http Content-Type: multipart/form-data; boundary=XyZ Content-Type: application/x-www-form-urlencoded ``` with a genuine multipart body containing `cmd=evil` and a `shell.php` file upload. Against commit `19b86824`: - `reqbodyProcessor` resolves to `"URLENCODED"` (the second, spoofed header wins). - The URL-encoded processor runs against the raw multipart body text, parses without error, and produces nothing. - `ARGS_POST:cmd`, `FILES`, and `FILES_NAMES` are all empty -- the entire payload is invisible to any rule inspecting those variables. - The backend (or any integrator using `Header.Get`, which reads the first value) still sees `Content-Type: multipart/form-data` and parses `cmd=evil` and the uploaded `shell.php` normally. Current OWASP CRS includes rule `920620` (`Content-Type` header sanity check via count/format), which catches this shape; the recommended `coraza.conf-recommended` has no equivalent, so a Coraza deployment with only custom rules (no CRS) is exposed. ### Fix Only the first `Content-Type` header may set `reqbodyProcessor`: guard the existing logic with `if tx.variables.reqbodyProcessor.Get() == ""`. This makes header-driven processor selection consistent with `ProcessRequestBody`'s own `mimeType` extraction and with standard `Header.Get` semantics, without a new field (nothing else can set `reqbodyProcessor` before headers finish processing; `ctl:requestBodyProcessor` and `ForceRequestBodyVariable` both run afterward, in phase 1 rule evaluation and body processing respectively, and are unaffected). As defense in depth, a rule author can also detect the anomaly directly today, with no code change: `SecRule &REQUEST_HEADERS:Content-Type "@gt 1" "deny,..."` -- left as a suggested addition to `coraza.conf-recommended` rather than bundled into this fix, since it is a policy choice (deny vs. flag) rather than a correctness requirement. ### AI involvement disclosure - **AI tools/models used:** Claude Sonnet 5 (Anthropic), via Claude Code. - **What was generated/assisted:** the vulnerability hypothesis and repro shape were supplied by the reporter as an existing written finding; Claude Sonnet 5 independently re-derived the root cause by reading the current source, traced the `mimeType`/`Header.Get` first-value asymmetry, wrote and ran a fresh PoC against commit `19b86824` confirming the full bypass (`ARGS_POST`/`FILES`/`FILES_NAMES` all empty), verified the fix closes it, and drafted this addendum. - **Review performed:** reproduced by hand against a clean checkout of commit `19b86824` before and after the fix using the real `Transaction` API (`AddRequestHeader` x2, `WriteRequestBody`, `ProcessRequestBody`); confirmed the regression test fails deterministically against the pre-fix code and passes after it; ran the full test suite, the build-tag matrix (`coraza.no_memoize`, `coraza.rule.multiphase_evaluation`, `coraza.rule.no_regex_multiline`), and the `testing/coreruleset` CRS regression suite, all green; reviewed by a human maintainer (fzipi) before this addendum was submitted. Fix: https://github.com/corazawaf/coraza-ghsa-w253-m66g-rx24/pull/2 ### Patched in 3.8.1 The 3.8.0 fix was incomplete. 3.8.1 completes it: only the first `Content-Type` header now selects the body processor (the one a typical backend reads with `Header.Get`), and leading whitespace in the media type, including Unicode whitespace that `net/http` accepts, is trimmed the way `mime.ParseMediaType` trims it. Upgrade to 3.8.1; 3.8.0 is listed as affected. ### Severity (revised 2026-10-02) `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N` (5.8, Medium). Attack Complexity is Low: every form and multipart parser accepts these Content-Type values. The previous vector used Scope Unchanged (5.3). Impact metrics follow the convention used across Coraza's WAF-bypass advisories: the vulnerable component is Coraza, but the impact lands on the protected application, so Scope is Changed. The bypass hides a payload from inspection; the application still has to be vulnerable to it, so Integrity is Low and Confidentiality is not scored separately. _AI involvement in this section: Claude Opus 5.5 (Anthropic), via Claude Code, re-derived the CVSS vector from the project's triage guidance (AGENTS.md, "CVSS preconditions get verified, not copied from the report") and drafted this text. A human maintainer (fzipi) chose the `S:C/I:L` impact convention and directed this update._
PoC: node2shell-scanner
High fidelity detection mechanism for node2shell (CVE-2026-111497)
PoC: http2shell-CVE-2026-111497
PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosure, DoS, or RCE when processing crafted compressed data.
PoC: runcloud-php2shell-patch
Build script for PHP (7.2 - 8.1) binaries mitigating PHP2Shell (CVE-2026-109618, CVE-2026-109619) on RunCloud Ubuntu servers.
PoC: php2shell-scan
A deliberately limited, read-only security scanner for assessing exposure to CVE-2026-109618 (RFC 1867 multipart OOM memory corruption) and CVE-2026-109619 (stale global state use-after-free) in PHP deployments.
PoC: CVE-2026-98260-OnePlus16-PYB110-Jailbreak
CVE-2026-98260 (exec: posix CPU timer UAF) - one-command temporary root for OnePlus 16 (PYB110) from uid 2000 shell, with KernelSU/FinaSU handover
PoC: php2shell-wordpress-rce-fullchain
Pre-auth RCE against WordPress (7.1.2/7.1.3) via PHP2Shell CVE-2026-109618 / CVE-2026-109619
PoC: php2shell-scanner
Audit & Vulnerability Detection Scanner for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) with Hardening Guidelines
PoC: php2shell-wordpress-check
A read-only Site Health check that compares the PHP version your site is running with the releases that fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
PoC: CVE-2026-111497
Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready reports.
PoC: AI-Threat-Detection-PHP-CGI-Vulnerabilities
A curated, deep-dive guide to leveraging Artificial Intelligence, Machine Learning, and Large Language Models (LLMs) to detect, analyze, and neutralize advanced web application threats—with a specific focus on recent, critical PHP CGI Argument Injection vulnerabilities (such as CVE-2024-4577) and similar Remote Code Execution (RCE) breaches.
PoC: php2shell-doctor
The safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619). Local, offline, vendor-backport aware.
PoC: node2shell-lab
Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-calibrated. Part of the *2Shell lab series. EN/中文/日本語.
PoC: php2shell-ioc
Curated IoCs, detection engineering rules, and automated threat intel feeds for PHP2Shell (CVE-2026-109618 & CVE-2026-109619).
PoC: php2shell-toolkit
CVE-2026-109618 PHP session.upload_progress detection & authorized testing toolkit
PoC: HTTP2Shell-PoC
PoC for CVE-2026-111497 (HTTP2Shell)
PoC: cve-2024-10441-synology-rce
Writeup y PoC educativo de CVE-2024-10441 (RCE pre-auth como root en Synology DSM via synoplugind). CVE ya parcheado; uso autorizado/defensivo.
PoC: php2shell-migration
Agent Skills skill to detect, patch and verify PHP apps affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619) or outdated PHP. Works with Claude Code, Codex, Copilot, Cursor, Gemini CLI, OpenCode.
PoC: php2shell
CVE-2026-109618 exploit tool — RCE via OOM ghost bucket in PHP POST parsing (CVSS 9.2)
PoC: php82-ubuntu2404-backport
PHP 8.2.35 rebuild (CVE-2026-109618 / CVE-2026-109619 fix, no telemetry) for Ubuntu 24.04 hosts running php8.2 8.2.7-1ubuntu1
PoC: CVE-2026-109618-109619-php2shell
CVE-2026-109618-109619 PHP2shell
PoC: php2shellscanner-web
Browser-based terminal-style UI for assetnote's php2shell-scanner (CVE-2026-109618 / CVE-2026-109619), with live per-probe SSE activity log and JSON export. Detection engine by assetnote; original discovery by Calif.
PoC: php2shell-research-public
Reproducible local Docker lab for CVE-2026-109618 PHP-FPM validation
PoC: PHP2shell
PHP2Shell — Unauthenticated RCE chain exploiting CVE-2026-109618 (OOM memory corruption) + CVE-2026-109619 (stale global state) in PHP.
PoC: B63-POC-CVE-2026-20131
CVE-2026-20131 (Cisco FMC): pre-auth Java deserialization to root — VERIFIED-AT-PRIMITIVE showcase artifact (rebuilt twins; appliance not executed, entitlement-gated)
PoC: B63-POC-CVE-2026-75650
CVE-2026-75650 (StyleSmuggler): unauthenticated RCE via template injection in Magento Open Source / Adobe Commerce 2.4.4–2.4.9 — b63 showcase, lab-verified with patched-build negative test
PoC: CVE-2026-98260-pudding-android
Target-specific Android CVE-2026-98260 research port for Xiaomi 17 (pudding)
PoC: node2shell-detector
node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.
PoC: hdu-is-work1
Secure REST API with CI/CD security scanning (Bandit SAST + pip-audit SCA) and a reproducible CVE-2017-1000028 lab (GlassFish 4.1)
PoC: php81-el7-php2shell
Unofficial CentOS 7 (EL7) rebuild of Remi php-8.1.34-6 with the PHP2Shell (CVE-2026-109618, CVE-2026-109619) mitigation
PoC: sl0ppy-riftscan-CVE-2026-42945
riftscan module for metasploit msf for cve CVE-2026-42945
PoC: CVE-2026-84589-macOS-TCC-Bypass
CVE-2026-84589: macOS TCC privacy bypass via FaceTime impersonation. Technical PoC analysis, Apple disclosure timeline, and patch coverage.
PoC: php2shell-fixer
Claude Code plugin: audit and patch PHP2Shell (CVE-2026-109618/109619) on Debian/Ubuntu PHP servers
PoC: PHP-CVE-2026-115560-Cheker-v-1.0
PHP alerta de CVE-2026-115560 PERO SABES SI TUS SISTEMAS SON VULNERABLES? Bueno amigos hice un script que checa si eres vulnerable y te dice exactamente que parámetros modificar para no estar vulnerable pero la buena noticia es que, según el propio proyecto, se trata de un riesgo poco probable en la práctica.
PoC: test-php
Controlled lab pinned to PHP 8.3.35 for reproducing/patch-verifying PHP2Shell (CVE-2026-109618, CVE-2026-109619)
PoC: CVE-2026-109618
CVE-2026-109618 - PHP session.upload_progress Heap UAF Pre-Auth RCE (CVSS 9.2)
PoC: CVE-2026-109619
CVE-2026-109619 - PHP session.upload_progress File Poisoning + LFI RCE (CVSS 9.2)
PoC: http2shell-check
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.
PoC: php2shell-behind-nginx
php2shell (CVE-2026-109618/9) behind nginx: measurements, lab, and an app-LFI chain that survives a proxy
PoC: CVE-2026-116106
CVE-2026-116106 - HeyCyan App 1.0.103 (Android) controle de acesso incorreto no FileProvider (CWE-284) - VulDB VDB-426174
PoC: CVE-2026-116105
CVE-2026-116105 - HeyCyan App 1.0.103 (Android) transmissao em texto claro / cleartext transmission (CWE-319) - VulDB VDB-426173
PoC: C-A-S
C.A.S-Exploit — Python-based security research and proof-of-concept toolkit for CVE-2017-5689 (Intel AMT authentication bypass), featuring Shodan discovery, HTTP/WS-Management testing, batch scanning, and vulnerability logging.
PoC: php2shell-monitor-rz
PHP2Shell Monitor - Real-time detection for CVE-2026-109618/109619 exploitation attempts
PoC: msgpack-CVE-2021-23410-test.hpp
the improve SourceInfo UX around server:
PoC: php2shell-unchained
Isolated Docker adversary-emulation lab: PHP2Shell (CVE-2026-109618/619, CVE-2026-115560) exploit chains, 11-scenario patch & WAF audit, Sliver C2, Cloudflare Quick Tunnel + Tor egress, guided mitigation validation.
PoC: Root-My-Galaxy-Payloads-SM-S928B
SM-S928B / S928BXXU6EZIF port of the CVE-2026-43499 app payload - work in progress, not yet rooted
PoC: CVE-2026-0073
CVE-2026-0073: Android adbd TLS auth bypass PoC. Exploits a logic bug where OpenSSL's EVP_PKEY_cmp() returns -1 on key type mismatch (EC vs RSA), incorrectly evaluating to true and granting access. Includes functional Python and standalone C exploits to gain unauthenticated remote shell on Android devices with Wireless Debugging enabled.
PoC: CVE-2025-26326
CVE-2025-26326 - vulnerabilidade critica em add-ons de conexao remota do NVDA (recuperado)
PoC: CVE-2024-6387-how-to-fix
Guia de correcao e mitigacao da CVE-2024-6387 (regreSSHion / OpenSSH) (recuperado)
PoC: Cloudflare-Exploits-CVE-2026-14440-CVE-2026-3125-CVE-2025-0651
PoC e exploits para CVE-2026-14440 (Universal SSL CAA Bypass), CVE-2026-3125 (OpenNext SSRF), CVE-2025-0651 (WARP Windows Privesc) | By Gh0st-Bx1
PoC: Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619
Bigfix PHP Vulnerability Scanner Content (CVE-2026-109618, CVE-2026-109619) for Windows, Linux and Mac.
PoC: PHP2Shell
A local Docker-based research lab for investigating PHP2Shell (CVE-2026-109618 and CVE-2026-109619), comparing PHP 8.4.26 and 8.4.27, and validating upstream security fixes and regression tests.
PoC: Galaxy-Tab-S10FE-Root
One-command ADB root for Samsung Galaxy Tab S10 FE (SM-X520, X520XXSACZH6): CVE-2026-43499 GhostLock exploit + KernelSU late-load. No bootloader unlock.
PoC: Fortinet-Exploits-CVE-2026-39808-106173-107656
PoC e Exploits completos para CVE-2026-39808 (FortiSandbox RCE), CVE-2026-106173 (FortiSIEM gRPC Path Traversal RCE) e CVE-2026-107656 (FortiSandbox Auth Bypass) - CVSS 9.6-9.8
PoC: bug-free-broccoli
CVE-2026-59248
PoC: php2shell-checker
Check PHP for PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed PHP and Ubuntu/Debian/AlmaLinux packages, plus a read-only version check script.
PoC: http2shell-checker
Check Node.js, Bun, Python Brotli and libbrotli for HTTP2Shell / Node2Shell (CVE-2026-111497): fixed versions and a read-only version check script.
PoC: CVE-2026-109618-109619-checker
CVE-2026-109618 / 109619 checker
PoC: CVE-2026-106781
CVE-2026-106781 CH341SER Driver Installer Privilege Escalation
PoC: CVE-2026-112900-PoC
Proof of Concept (PoC) demonstrating Argument Injection in Pillow's Ghostscript call (Pillow < 13.0.0) potentially leading to arbitrary command execution (RCE).
PoC: Root-My-Galaxy-S4
Root the Samsung Galaxy S4 on official firmware via CVE-2015-1805 & KNOX e-fuse stays intact
PoC: ksu-root
在 REDMI K90 Max（代号 prague / OS4.0.0.14）上，从手机端一键开一个临时 root。利用 CVE-2026-64560（posix-cpu-timers UAF）加载 KernelSU LKM，重启即失效。不需要电脑、不刷机、不解锁 Bootloader。
PoC: CVE-2026-115560
PHP session.upload_progress Enabled - CVE-2026-115560 Precondition
PoC: php2shell
php2shell(CVE-2026-109618 / CVE-2026-109619) EXP
PoC: cve-2026-98260-vivo-gki-research
Research notes: porting CVE-2026-98260 to vivo/iQOO GKI 6.6.127 (no exploit code; coordinated disclosure planned)
PoC: brotli-cve-check
Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes
PoC: php2shellX
Next-generation exploit orchestrator for CVE-2026-109618/619 — adds Cloudflare WAF bypass, flexible target specification (URL/host/port/path/batch), multi-format output (JSON/CSV/table), resume capability, and lab automation (Docker restart). Authored by TESTERXMA.
PoC: a12-ghostlock
One-click root for the Samsung Galaxy A12 (SM-A125F) via CVE-2026-43499 (GhostLock) - KernelSU-compatible userspace stack, grant dialog, verified root in Neo Backup / App Manager / Shizuku
PoC: o3root
Shizuku-driven CVE-2026-98260 root + KernelSU runtime LKM loader for Xiaomi yingtian / lhasa (kernel 6.18.21)
PoC: homebrew-php2shell-doctor
Homebrew tap for php2shell-doctor - the safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619)
PoC: php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free
php:7.4-fpm-CVE-2026-109618-109619-free
PoC: cve-2026-25262-poc
CVE-2026-25262 (Qualcomm BootROM) deep-dive on the Black Hat Asia 2026 'A journey through Sahara' talk + read-only Sahara/EDL recon harness. GPLv3.
PoC: CVE-2026-74580
CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration - Exploit
PoC: php2shell
Патчи безопасности и сканер аудита для FastPanel и Debian PHP против уязвимостей CVE-2026-109618 и CVE-2026-109619 (PHP 5.2–8.1). Пошаговые руководства по сборке.
PoC: log4shell-audit-4
Quarterly security briefing research notes and remediation tracking for Log4Shell (CVE-2021-44228).
PoC: CEV-2020-25213_wp-file-manger_exploit
CVE-2020-25213 - Unauthenticated RCE exploit for WP File Manager plugin (≤ 6.0) | Educational purposes only
PoC: php-vulns-discovered-23-10-2026
Patch temporanee per sistemi con versioni di PHP inferiori a 8.2.35 contro CVE-2026-109618 - CVE-2026-109619 - CVE-2026-115560
PoC: CVE-2026-109618-php56-public
Exact-build PHP 5.6 research and reproducible labs for CVE-2026-109618 and CVE-2026-109619
PoC: Compiled-CVE-2023-21752
Compiled version of Wh04m1001's exploit for iwr/wget delivery to VM.
PoC: CVE-2026-83548
CVE-2026-83548 — SonicWall SMA1000 Work Place pre-auth SSRF
PoC: CVE-2026-64849
CVE-2026-64849 — MLflow SSRF
PoC: CVE-2026-21627
CVE-2026-21627 proof of concept and exploit script
PoC: php8.1-cve-109618-109619-fix
php:8.1.34-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: php7.4-cve-109618-109619-fix
php:7.4.33-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: php2shell
Exploit & analysis for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Demonstrating memory disclosure, ASLR bypass, and RCE via session.upload_progress memory bailout dangling pointers.
PoC: php2shell-demo
🛡️ Hands-on defensive Docker lab for the October 2026 RCE week — PHP2Shell (CVE-2026-109618/619), Node.js Brotli & Next.js sharp. See the attack surface and blast radius, and learn to shut them down. No exploits.
PoC: CVE-2026-115560
CVE-2026-115560: PHP session upload-progress serialize_handler mismatch → pre-auth object injection → RCE. Check/exploit/verify scripts + Docker lab + Suricata/Sigma detection rules.
PoC: CVE-2026-86426
CVE-2026-86426 CHECK
PoC: php-radar
Detection-only exposure scanner for PHP2Shell (CVE-2026-109618/109619): finds PHP across repositories, hosts, a network perimeter, and AWS, and grades each install by version and config without triggering the bug.
PoC: spip-cve-2026
PoC for CVE-2026-72708 (blind SQLi) and CVE-2026-109378 (SSRF) in SPIP, both fixed in 4.4.18
PoC: php2shell
PHP2Shell: finding and patching affected PHP CVE-2026-109618 and CVE-2026-109619
PoC: php2shell-audit
Exposure scanner, patch verifier and threat hunter for CVE-2026-109618/9, with a cyberpunk TUI.
PoC: DFRoot
Fork of datfooldive/DFRoot (DirtyFrag CVE-2026-43284, ReSukiSU) + GitHub Actions APK build
PoC: php8-cve-109618-109619-fix
php:8.0.30-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: brotli-secfix
Security backport toolkit for CVE-2026-111497 on Ubuntu 24.04, featuring upstream patch verification, custom Debian package builds, and offline remediation procedures.
PoC: CVE-2026-88009-PoC
CVE-2026-88009 — Traefik forwards a rootless opaque request target that routing/forwardAuth see as '/'. Auth bypass + access-log evasion, verified v3.7.10 / v3.7.13.
PoC: CVE-2026-85595-PoC
CVE-2026-85595 — Traefik digestAuth authentication bypass (unknown username => empty HA1). Lab-verified: v3.7.10 bypass, v3.7.11 401.
PoC: CVE-2026-85168-PoC
CVE-2026-85168 — n8n Git node RCE from repo-local filter.*.clean / merge-driver config on add|commit|checkout. Verified v2.35.3 / v2.36.2.
PoC: CVE-2026-86076-PoC
CVE-2026-86076 — n8n expression sandbox escape via class-field __sanitize rebinding (backend RCE). Verified v2.37.6 (uid=node) / v2.37.7.
PoC: CVE-2026-109618-CVE-2026-109619-php2shell-
MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.
PoC: CVE-2026-111497-node2shell
CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free