php2shell-poc
Research PoC: PHP session.upload_progress pre-auth RCE chains with detection rules
Visit php2shell-poc ↗
link: rel="ugc noopener"
php2shell-poc is a security research repository covering pre-authentication exploit research against PHP's session.upload_progress feature. It is associated with CVE-2026-109618 and CVE-2026-109619 and documents five remote code execution chains.
The repository also includes detection rules for Suricata, Sigma, and ModSecurity, which defenders can use to identify related activity. Details are published on the GitHub repository page linked above, including the exploit research and rule files.
Discussion