[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2qjh5e2cuyjnx":3},{"code":4,"message":5,"data":6,"timestamp":39},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":8,"hn_threads":14,"one_liner":15,"summary_md":16,"topic":17,"github_topics":20,"license":35,"homepage":36,"updated_at":37,"history":38},"ikow\u002Fphp2shell-poc",3,"CVE-2026-109618\u002F109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.","Python",1754,608,474,[],"Exploit and detection toolkit for two critical PHP pre-auth RCE bugs affecting nearly every default PHP install.","## The problem\n\nA PHP vulnerability class that survives 14 years of releases is a defender's nightmare: you cannot read the app, patch it, or reason about it from the outside. This repo publishes five RCE chains around `session.upload_progress` and Zend engine OOM handling, plus detection rules and a Docker lab, so security teams can verify exposure and block the traffic instead of arguing about CVSS scores.\n\n## What's different\n\nMost PHP exploit repos ship a single PoC and stop at reproduction. This one bundles the exploit, the verification scripts, a multi-SAPI lab (FPM, nginx, Apache mod_php) and drop-in rules for Suricata, Sigma, ModSecurity and OpenResty in one tree. The chains are also graded by precondition — from \"app has an LFI sink\" up to \"any endpoint\" — which is the detail defenders actually need to triage. Notably, two of the five chains, including the zero-dependency one, are withheld behind a paid Substack subscription; the free repo is a partial disclosure.\n\n## Who it's for\n\nSecurity engineers, pentesters with written authorization, and sysadmins running PHP-FPM or mod_php who need to confirm whether their stack is exposed and deploy WAF\u002FIDS signatures today. It is not for application developers who just want to fix their own code — the actionable output for them is a one-line INI change and a PHP patch, not exploit tooling. It also assumes comfort with Docker, Python 3 and reading PHP internals.\n\n## Cost of adoption\n\nPython for the driver scripts, PHP for Chain B, Docker Compose for the lab. MIT-licensed code, but the most severe chains (D and E) are gated, so \"complete coverage\" is not free. The README is thin on methodology: the CVE identifiers, GHSA links and patch commit are given without the underlying analysis, and the full writeup lives off-site. Treat the claims as a starting point to verify in the lab, not as settled fact. The ruleset is a snapshot, so expect to tune signatures against your own traffic to avoid false positives on file uploads.\n\n## Verdict\n\nThe repo went from zero to roughly 1,750 stars in three days — a publication spike tied to the disclosure, not a community that has stress-tested it. There is no Hacker News thread and no trending-board history, so the signal is one burst plus a paid-content funnel. The free chains plus the detection rules are genuinely useful for defenders within a patch window; the paywalled zero-dependency chains weaken its value as a reference. Use it to drive a patching and WAF rollout, and do not rely on it as your only source on the vulnerability.",{"slug":18,"name":19},"security","Security & Privacy",[21,22,23,24,25,26,27,28,29,30,31,32,33,34],"cve-2026-109618","cve-2026-109619","detection-rules","exploit","php-exploit","php-security","php2shell","poc","rce","session-upload-progress","suricata-rules","vulnerability-research","waf-rules","wordpress-security","MIT",null,"2026-10-24T21:06:32Z",[],1792890675]