FarhadHosen101/PHP2Shell-CVE-2026-109619

PoC

Advanced Pre-Auth RCE Exploit for PHP session.upload_progress (CVE-2026-109618 & 109619) by Farhad Hosen.

view exploit source poc_in_githubauthor FarhadHosen101published 2026-10-22catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2026-109619UShigh8.1OT criticalKEV
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The g…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan