{"ok":true,"repo":{"id":238111,"full_name":"ikow/php2shell-poc","url":"https://github.com/ikow/php2shell-poc","description":"CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.","language":"Python","topics":["cve-2026-109618","cve-2026-109619","detection-rules","exploit","php-exploit","php-security","php2shell","poc","rce","session-upload-progress","suricata-rules","vulnerability-research","waf-rules","wordpress-security"],"stars":1754,"stars_delta":818,"forks":610,"first_seen":"2026-10-22T00:05:41.758792Z","last_seen":"2026-10-25T02:20:41.653452Z","mentions":0,"platforms":[],"score":0.0,"summary":"php2shell is a proof-of-concept and detection toolkit for two critical PHP vulnerabilities (CVE-2026-109618/109619) exploiting session.upload_progress and Zend engine OOM bailouts. It includes five pre-auth RCE chains affecting PHP 5.4–8.5, with three public exploits, lab setup, and detection rules for the patched bugs.","why":"Freshly released alongside a detailed writeup, it demonstrates pre-auth RCE with no app-level vulnerability required (Chain D against mod_php), impacting most PHP websites — a major security story driving attention.","audience":"Security researchers, penetration testers, and PHP sysadmins needing to test exposure and deploy detection rules.","tags":["security","php","exploit","rce","cve","poc"],"summarized_at":"2026-10-22T00:21:32.515163Z","summary_model":"glm-5.3-flash","fetched_at":"2026-10-25T02:21:20.885395Z","meta":{"license":"MIT","archived":false,"homepage":null,"first_stars":936},"pushed_at":"2026-10-22T22:41:36Z","created_at":"2026-10-21T07:55:16Z","watchers":7,"open_issues":6,"mentions_list":[{"platform":"github","url":"https://github.com/search?q=created%3A%3E2026-10-11&s=stars&o=desc","title":"new repos, most starred","seen_at":"2026-10-25T02:20:41.653712Z"},{"platform":"github","url":"https://github.com/search?q=created%3A%3E2026-10-10&s=stars&o=desc","title":"new repos, most starred","seen_at":"2026-10-24T23:50:41.406063Z"},{"platform":"github","url":"https://github.com/search?q=created%3A%3E2026-10-09&s=stars&o=desc","title":"new repos, most starred","seen_at":"2026-10-23T23:50:41.871969Z"},{"platform":"github","url":"https://github.com/search?q=created%3A%3E2026-10-08&s=stars&o=desc","title":"new repos, most starred","seen_at":"2026-10-22T23:50:41.680434Z"}],"snapshots":[{"captured_at":"2026-10-22T00:21:27.789933Z","stars":936,"forks":329},{"captured_at":"2026-10-22T00:35:57.544964Z","stars":945,"forks":332},{"captured_at":"2026-10-22T00:50:52.111241Z","stars":954,"forks":333},{"captured_at":"2026-10-22T01:05:53.335985Z","stars":968,"forks":338},{"captured_at":"2026-10-22T01:20:53.668953Z","stars":979,"forks":343},{"captured_at":"2026-10-22T01:35:55.648573Z","stars":990,"forks":349},{"captured_at":"2026-10-22T01:50:54.340558Z","stars":1001,"forks":355},{"captured_at":"2026-10-22T02:05:55.243777Z","stars":1016,"forks":367},{"captured_at":"2026-10-22T02:20:55.040974Z","stars":1029,"forks":371},{"captured_at":"2026-10-22T02:35:55.579935Z","stars":1045,"forks":379},{"captured_at":"2026-10-22T02:50:57.140191Z","stars":1053,"forks":380},{"captured_at":"2026-10-22T03:05:55.691853Z","stars":1060,"forks":386},{"captured_at":"2026-10-22T03:20:56.643862Z","stars":1069,"forks":392},{"captured_at":"2026-10-22T03:35:56.540139Z","stars":1080,"forks":395},{"captured_at":"2026-10-22T03:50:56.266487Z","stars":1086,"forks":397},{"captured_at":"2026-10-22T04:05:57.053788Z","stars":1096,"forks":400},{"captured_at":"2026-10-22T04:20:56.441878Z","stars":1105,"forks":403},{"captured_at":"2026-10-22T04:35:56.462799Z","stars":1113,"forks":404},{"captured_at":"2026-10-22T04:50:58.243586Z","stars":1122,"forks":406},{"captured_at":"2026-10-22T05:05:57.364171Z","stars":1128,"forks":408},{"captured_at":"2026-10-22T05:20:59.701472Z","stars":1134,"forks":414},{"captured_at":"2026-10-22T05:36:01.441314Z","stars":1141,"forks":417},{"captured_at":"2026-10-22T06:06:16.847063Z","stars":1162,"forks":426},{"captured_at":"2026-10-22T06:21:02.518145Z","stars":1175,"forks":430},{"captured_at":"2026-10-22T06:36:11.246917Z","stars":1188,"forks":434},{"captured_at":"2026-10-22T06:51:03.765549Z","stars":1200,"forks":438},{"captured_at":"2026-10-22T07:06:04.840842Z","stars":1206,"forks":441},{"captured_at":"2026-10-22T07:21:03.569492Z","stars":1218,"forks":447},{"captured_at":"2026-10-22T07:36:03.446195Z","stars":1224,"forks":451},{"captured_at":"2026-10-22T07:51:04.440774Z","stars":1236,"forks":454},{"captured_at":"2026-10-22T08:06:04.940191Z","stars":1241,"forks":456},{"captured_at":"2026-10-22T08:21:05.340664Z","stars":1253,"forks":457},{"captured_at":"2026-10-22T08:36:04.640650Z","stars":1260,"forks":459},{"captured_at":"2026-10-22T08:51:05.268649Z","stars":1273,"forks":464},{"captured_at":"2026-10-22T09:06:04.694204Z","stars":1283,"forks":465},{"captured_at":"2026-10-22T09:21:05.240569Z","stars":1287,"forks":466},{"captured_at":"2026-10-22T09:36:07.041383Z","stars":1296,"forks":467},{"captured_at":"2026-10-22T09:51:09.741891Z","stars":1302,"forks":470},{"captured_at":"2026-10-22T10:06:06.826874Z","stars":1310,"forks":473},{"captured_at":"2026-10-22T10:21:06.660278Z","stars":1314,"forks":476},{"captured_at":"2026-10-22T10:36:07.065499Z","stars":1319,"forks":479},{"captured_at":"2026-10-22T10:51:05.947241Z","stars":1326,"forks":482},{"captured_at":"2026-10-22T11:06:28.340320Z","stars":1333,"forks":483},{"captured_at":"2026-10-22T11:21:09.101953Z","stars":1334,"forks":484},{"captured_at":"2026-10-22T11:36:08.660117Z","stars":1341,"forks":487},{"captured_at":"2026-10-22T11:51:08.656933Z","stars":1346,"forks":489},{"captured_at":"2026-10-22T12:06:12.839737Z","stars":1350,"forks":491},{"captured_at":"2026-10-22T12:21:16.795901Z","stars":1353,"forks":493},{"captured_at":"2026-10-22T12:36:10.139761Z","stars":1357,"forks":495},{"captured_at":"2026-10-22T12:51:10.321959Z","stars":1362,"forks":496},{"captured_at":"2026-10-22T13:06:13.140547Z","stars":1367,"forks":497},{"captured_at":"2026-10-22T13:21:12.018526Z","stars":1371,"forks":498},{"captured_at":"2026-10-22T13:36:11.880972Z","stars":1380,"forks":499},{"captured_at":"2026-10-22T13:51:14.042819Z","stars":1385,"forks":499},{"captured_at":"2026-10-22T14:06:12.192738Z","stars":1392,"forks":502},{"captured_at":"2026-10-22T14:21:12.466246Z","stars":1398,"forks":503},{"captured_at":"2026-10-22T15:21:20.840294Z","stars":1425,"forks":510},{"captured_at":"2026-10-22T15:36:12.754029Z","stars":1425,"forks":511},{"captured_at":"2026-10-22T15:51:12.990222Z","stars":1431,"forks":511},{"captured_at":"2026-10-22T16:06:12.598823Z","stars":1436,"forks":513},{"captured_at":"2026-10-22T16:21:46.241591Z","stars":1440,"forks":515},{"captured_at":"2026-10-22T16:36:13.444295Z","stars":1443,"forks":516},{"captured_at":"2026-10-22T16:51:15.240577Z","stars":1444,"forks":517},{"captured_at":"2026-10-22T17:06:21.443661Z","stars":1445,"forks":519},{"captured_at":"2026-10-22T17:21:14.641099Z","stars":1448,"forks":522},{"captured_at":"2026-10-22T17:36:12.340280Z","stars":1452,"forks":522},{"captured_at":"2026-10-22T17:51:12.859275Z","stars":1453,"forks":524},{"captured_at":"2026-10-22T18:06:14.340277Z","stars":1456,"forks":524},{"captured_at":"2026-10-22T18:21:29.462065Z","stars":1458,"forks":525},{"captured_at":"2026-10-22T18:36:14.241043Z","stars":1459,"forks":526},{"captured_at":"2026-10-22T18:51:13.862021Z","stars":1460,"forks":526},{"captured_at":"2026-10-22T19:06:23.442431Z","stars":1465,"forks":527},{"captured_at":"2026-10-22T19:21:15.442653Z","stars":1468,"forks":528},{"captured_at":"2026-10-22T19:36:21.441279Z","stars":1472,"forks":528},{"captured_at":"2026-10-22T19:51:15.143096Z","stars":1475,"forks":529},{"captured_at":"2026-10-22T20:06:13.637398Z","stars":1477,"forks":530},{"captured_at":"2026-10-22T20:21:14.640169Z","stars":1481,"forks":531},{"captured_at":"2026-10-22T20:36:13.296595Z","stars":1485,"forks":531},{"captured_at":"2026-10-22T20:51:15.663067Z","stars":1487,"forks":531},{"captured_at":"2026-10-22T21:06:14.646860Z","stars":1491,"forks":530},{"captured_at":"2026-10-22T21:21:15.441861Z","stars":1493,"forks":531},{"captured_at":"2026-10-24T20:37:28.940871Z","stars":1750,"forks":607},{"captured_at":"2026-10-24T20:51:13.808463Z","stars":1751,"forks":607},{"captured_at":"2026-10-24T21:06:13.746309Z","stars":1751,"forks":607},{"captured_at":"2026-10-24T21:21:16.833881Z","stars":1751,"forks":607},{"captured_at":"2026-10-24T21:36:18.893772Z","stars":1751,"forks":607},{"captured_at":"2026-10-24T21:51:13.792479Z","stars":1751,"forks":607},{"captured_at":"2026-10-24T22:06:15.241678Z","stars":1752,"forks":607},{"captured_at":"2026-10-24T22:21:13.817956Z","stars":1753,"forks":607},{"captured_at":"2026-10-24T22:36:13.244427Z","stars":1753,"forks":607},{"captured_at":"2026-10-24T22:51:14.095033Z","stars":1753,"forks":607},{"captured_at":"2026-10-24T23:06:19.682474Z","stars":1753,"forks":607},{"captured_at":"2026-10-24T23:21:15.448989Z","stars":1753,"forks":607},{"captured_at":"2026-10-24T23:36:13.937519Z","stars":1753,"forks":607},{"captured_at":"2026-10-24T23:51:13.240613Z","stars":1754,"forks":607},{"captured_at":"2026-10-25T00:06:32.570212Z","stars":1754,"forks":607},{"captured_at":"2026-10-25T00:21:15.996042Z","stars":1754,"forks":607},{"captured_at":"2026-10-25T00:36:16.540818Z","stars":1754,"forks":608},{"captured_at":"2026-10-25T00:51:16.082440Z","stars":1754,"forks":609},{"captured_at":"2026-10-25T01:06:15.532598Z","stars":1754,"forks":609},{"captured_at":"2026-10-25T01:21:17.124078Z","stars":1755,"forks":609},{"captured_at":"2026-10-25T01:36:15.758968Z","stars":1755,"forks":609},{"captured_at":"2026-10-25T01:51:14.940585Z","stars":1754,"forks":609},{"captured_at":"2026-10-25T02:06:15.452463Z","stars":1754,"forks":610},{"captured_at":"2026-10-25T02:21:20.886080Z","stars":1754,"forks":610}]}}