{"schema":"vulnpedia.poc/1","cve":"CVE-2026-109619","generated":"2026-10-26T13:52:32.101Z","kev":null,"epss":{"score":0.99997,"percentile":0.99989},"cvss":{"version":"4.0","score":9.2,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},"has_public_poc":true,"poc_sources":[{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/d2c5e64d091d","executable":false,"sourceId":"d2c5e64d091d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"d2c5e64d091d","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/d2c5e64d091d"}],"repositoryUrl":"https://github.com/cereZ23/php-up-2026"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/fe74549ca89f","executable":false,"sourceId":"fe74549ca89f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"fe74549ca89f","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/fe74549ca89f"}],"repositoryUrl":"https://github.com/murrez/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/419b22bb0c9d","executable":false,"sourceId":"419b22bb0c9d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"419b22bb0c9d","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/419b22bb0c9d"}],"repositoryUrl":"https://github.com/anmolksachan/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/afee80097430","executable":false,"sourceId":"afee80097430","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"afee80097430","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/afee80097430"}],"repositoryUrl":"https://github.com/unlimit0118/CVE-2026-109619-php2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/a13385ce95a0","executable":false,"sourceId":"a13385ce95a0","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a13385ce95a0","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/a13385ce95a0"}],"repositoryUrl":"https://github.com/Felix3322/PHP-uniDoS"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/cc63afbc2556","executable":false,"sourceId":"cc63afbc2556","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"cc63afbc2556","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/cc63afbc2556"}],"repositoryUrl":"https://github.com/al4n4n/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/b97bbc624879","executable":false,"sourceId":"b97bbc624879","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b97bbc624879","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/b97bbc624879"}],"repositoryUrl":"https://github.com/david-alvarez-rosa/php-rce"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/1de913151c37","executable":false,"sourceId":"1de913151c37","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1de913151c37","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/1de913151c37"}],"repositoryUrl":"https://github.com/cozybear-dev/cve-2026-109619"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/5b4ee6f3e6d9","executable":false,"sourceId":"5b4ee6f3e6d9","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5b4ee6f3e6d9","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/5b4ee6f3e6d9"}],"repositoryUrl":"https://github.com/FranklinF25/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/350f85b61e0d","executable":false,"sourceId":"350f85b61e0d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"350f85b61e0d","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/350f85b61e0d"}],"repositoryUrl":"https://github.com/alvarodh5/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/9efa914b5033","executable":false,"sourceId":"9efa914b5033","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9efa914b5033","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/9efa914b5033"}],"repositoryUrl":"https://github.com/Stonlifer/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/96b45c265779","executable":false,"sourceId":"96b45c265779","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"96b45c265779","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/96b45c265779"}],"repositoryUrl":"https://github.com/devploit/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/f463c5f17bbf","executable":false,"sourceId":"f463c5f17bbf","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"f463c5f17bbf","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/f463c5f17bbf"}],"repositoryUrl":"https://github.com/Marven11/PHP2Shell-PoC"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/ca79732b1bd3","executable":false,"sourceId":"ca79732b1bd3","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"ca79732b1bd3","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/ca79732b1bd3"}],"repositoryUrl":"https://github.com/HORKimhab/CVE-2026-109618-619"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/18c0133ad077","executable":false,"sourceId":"18c0133ad077","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"18c0133ad077","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/18c0133ad077"}],"repositoryUrl":"https://github.com/WildanDeveloper/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/89f8fe966074","executable":false,"sourceId":"89f8fe966074","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"89f8fe966074","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/89f8fe966074"}],"repositoryUrl":"https://github.com/4B3R4M4-607D/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/488e371c3b4b","executable":false,"sourceId":"488e371c3b4b","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"488e371c3b4b","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/488e371c3b4b"}],"repositoryUrl":"https://github.com/joshuarosato/php2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/11591cf3fae4","executable":false,"sourceId":"11591cf3fae4","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"11591cf3fae4","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/11591cf3fae4"}],"repositoryUrl":"https://github.com/segfo/php2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/108de6a83877","executable":false,"sourceId":"108de6a83877","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"108de6a83877","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/108de6a83877"}],"repositoryUrl":"https://github.com/open0x01/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/6b1c6f3b8ab8","executable":false,"sourceId":"6b1c6f3b8ab8","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"6b1c6f3b8ab8","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/6b1c6f3b8ab8"}],"repositoryUrl":"https://github.com/pattingbabies/php2shell-CVE-2026-109618-109619"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/e5943f3a5adf","executable":false,"sourceId":"e5943f3a5adf","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"e5943f3a5adf","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/e5943f3a5adf"}],"repositoryUrl":"https://github.com/chamrouensqa/php2shell-cve-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/3ee3cc942b69","executable":false,"sourceId":"3ee3cc942b69","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"3ee3cc942b69","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/3ee3cc942b69"}],"repositoryUrl":"https://github.com/SanWRoot/php2shell-LAB-POC-"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/147e93dfb96d","executable":false,"sourceId":"147e93dfb96d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"147e93dfb96d","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/147e93dfb96d"}],"repositoryUrl":"https://github.com/mazdel/php2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/025ae90c5210","executable":false,"sourceId":"025ae90c5210","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"025ae90c5210","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/025ae90c5210"}],"repositoryUrl":"https://github.com/LHeiakim/php2shell-full-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/c13e0ced5741","executable":false,"sourceId":"c13e0ced5741","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"c13e0ced5741","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/c13e0ced5741"}],"repositoryUrl":"https://github.com/Marciano-Morinigo/php2shell-CVE-2026-109618-CVE-2026-109619-PoC-Lab"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/57db94e7f60d","executable":false,"sourceId":"57db94e7f60d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"57db94e7f60d","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/57db94e7f60d"}],"repositoryUrl":"https://github.com/definitiveref/php2shell-CVE-2026-109618-109619-Research"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/8f48fdd7f165","executable":false,"sourceId":"8f48fdd7f165","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"8f48fdd7f165","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/8f48fdd7f165"}],"repositoryUrl":"https://github.com/memuratozturk/php2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/b195732528c3","executable":false,"sourceId":"b195732528c3","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b195732528c3","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/b195732528c3"}],"repositoryUrl":"https://github.com/RuanSerraAzul/CVE-2026-109619-POC"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/0e36a61275ca","executable":false,"sourceId":"0e36a61275ca","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0e36a61275ca","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/0e36a61275ca"}],"repositoryUrl":"https://github.com/bigb0x/php2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/0c61dbebd37a","executable":false,"sourceId":"0c61dbebd37a","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0c61dbebd37a","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/0c61dbebd37a"}],"repositoryUrl":"https://github.com/leonewt0n/php2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/47d895e8edd9","executable":false,"sourceId":"47d895e8edd9","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"47d895e8edd9","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/47d895e8edd9"}],"repositoryUrl":"https://github.com/renyang-create/php2shell-repro"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/76114404529d","executable":false,"sourceId":"76114404529d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"76114404529d","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/76114404529d"}],"repositoryUrl":"https://github.com/MRdark-ops/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/3ab3f8f0809f","executable":false,"sourceId":"3ab3f8f0809f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"3ab3f8f0809f","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/3ab3f8f0809f"}],"repositoryUrl":"https://github.com/LeisureLinux/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/5f018492f442","executable":false,"sourceId":"5f018492f442","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5f018492f442","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/5f018492f442"}],"repositoryUrl":"https://github.com/EQSTLab/CVE-2026-109619"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/794a31805a84","executable":false,"sourceId":"794a31805a84","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"794a31805a84","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/794a31805a84"}],"repositoryUrl":"https://github.com/umair-aziz025/PHP2Shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/fa755ba28300","executable":false,"sourceId":"fa755ba28300","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"fa755ba28300","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/fa755ba28300"}],"repositoryUrl":"https://github.com/Kyros0324/CVE2026"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/a797b02a2d15","executable":false,"sourceId":"a797b02a2d15","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a797b02a2d15","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/a797b02a2d15"}],"repositoryUrl":"https://github.com/DarynOngera/solid-palm-tree"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/56a688eb716f","executable":false,"sourceId":"56a688eb716f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"56a688eb716f","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/56a688eb716f"}],"repositoryUrl":"https://github.com/agrresore/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/aaee58094f00","executable":false,"sourceId":"aaee58094f00","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"aaee58094f00","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/aaee58094f00"}],"repositoryUrl":"https://github.com/Ls-ComCSIRT/php2shell-scan"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/ab356d3799c4","executable":false,"sourceId":"ab356d3799c4","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"ab356d3799c4","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/ab356d3799c4"}],"repositoryUrl":"https://github.com/9hb/php2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/cae4f1f74438","executable":false,"sourceId":"cae4f1f74438","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"cae4f1f74438","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/cae4f1f74438"}],"repositoryUrl":"https://github.com/aarsaputra/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/a960e989589c","executable":false,"sourceId":"a960e989589c","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a960e989589c","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/a960e989589c"}],"repositoryUrl":"https://github.com/zake1god/php2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/b72b73806b3b","executable":false,"sourceId":"b72b73806b3b","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b72b73806b3b","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/b72b73806b3b"}],"repositoryUrl":"https://github.com/Noshadi-sec/cve-2026-109618-109619-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/9dfbf67c7875","executable":false,"sourceId":"9dfbf67c7875","verification":"catalogued","source":"vulncheck-kev","modified":"2026-10-21T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9dfbf67c7875","modified":"2026-10-21T00:00:00Z","url":"https://vulncheck.com/xdb/9dfbf67c7875"}],"repositoryUrl":"https://github.com/ihsansencan/Php2Shell-Lab"}],"detection_sources":[],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-109619%22&type=repositories","executable":false}],"poc_candidates":[{"url":"https://github.com/santihabib/CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"CVE-2026-109619: cross-request UAF in PHP session.upload_progress — reproduction, root-cause analysis and full chain to RCE","modified":"2026-10-22T14:11:28Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/santihabib/CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T14:11:28Z","url":"https://github.com/santihabib/CVE-2026-109619"}],"tags":[]},{"url":"https://github.com/fmdiscioglu/php-cve-2026-109619-checker","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"Non-destructive affected-version checker for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) PHP UAF","modified":"2026-10-21T14:39:26Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/fmdiscioglu/php-cve-2026-109619-checker"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-21T14:39:26Z","url":"https://github.com/fmdiscioglu/php-cve-2026-109619-checker"}],"tags":[]},{"url":"https://github.com/unlimit0118/CVE-2026-109619-php2shell-poc","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"Minimal PHP session upload progress use-after-free PoC and Docker lab.","modified":"2026-10-24T13:02:59Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/unlimit0118/CVE-2026-109619-php2shell-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-24T13:02:59Z","url":"https://github.com/unlimit0118/CVE-2026-109619-php2shell-poc"}],"tags":[]},{"url":"https://github.com/LordX404/php2shell-exploit","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"this is a exploit for CVE-2026-109619","modified":"2026-10-22T03:52:03Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/LordX404/php2shell-exploit"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T03:52:03Z","url":"https://github.com/LordX404/php2shell-exploit"}],"tags":[]},{"url":"https://github.com/cozybear-dev/cve-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-23T19:44:33Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/cozybear-dev/cve-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-23T19:44:33Z","url":"https://github.com/cozybear-dev/cve-2026-109619"}],"tags":[]},{"url":"https://github.com/1Nightlovel/CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"php2shellscanner","modified":"2026-10-21T19:28:10Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/1Nightlovel/CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-21T19:28:10Z","url":"https://github.com/1Nightlovel/CVE-2026-109619"}],"tags":[]},{"url":"https://github.com/syrex1013/CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-21T19:33:14Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/syrex1013/CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-21T19:33:14Z","url":"https://github.com/syrex1013/CVE-2026-109619"}],"tags":[]},{"url":"https://github.com/basesixtythree/B63-POC-CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"PoC and verification material for CVE-2026-109619 (PHP stale worker-global state)","modified":"2026-10-21T22:51:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/basesixtythree/B63-POC-CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-21T22:51:41Z","url":"https://github.com/basesixtythree/B63-POC-CVE-2026-109619"}],"tags":[]},{"url":"https://github.com/VKKKV/php2shell-exp","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"Profile-driven php2shell chain (CVE-2026-109619 class) for stock php:*-apache images; loopback lab only.","modified":"2026-10-22T08:02:56Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/VKKKV/php2shell-exp"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T08:02:56Z","url":"https://github.com/VKKKV/php2shell-exp"}],"tags":[]},{"url":"https://github.com/baimaobg/php-cve-2026-109619-lab","source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T07:49:51Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/baimaobg/php-cve-2026-109619-lab"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T07:49:51Z","url":"https://github.com/baimaobg/php-cve-2026-109619-lab"}],"tags":[]},{"url":"https://github.com/Prajjwal-Srivastava/php2shell_scanner","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"Scans a PHP host for CVE-2026-109619 (php2shell): fingerprints it, compares PHP version and build date against fixed releases, checks the advisory's producer and consumer preconditions, then prints a VULNERABLE, NOT VULNERABLE or UNKNOWN verdict with the evidence behind it.","modified":"2026-10-22T10:38:02Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/Prajjwal-Srivastava/php2shell_scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T10:38:02Z","url":"https://github.com/Prajjwal-Srivastava/php2shell_scanner"}],"tags":[]},{"url":"https://github.com/RuanSerraAzul/CVE-2026-109619-POC","source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T13:38:22Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/RuanSerraAzul/CVE-2026-109619-POC"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T13:38:22Z","url":"https://github.com/RuanSerraAzul/CVE-2026-109619-POC"}],"tags":[]},{"url":"https://github.com/mazdel/php2shell-poc","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"Zero-dependency Python PoC & Docker Compose reproduction for CVE-2026-109619 via PHP RFC1867 upload progress and opcache.preload. (133 characters)","modified":"2026-10-22T14:31:33Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/mazdel/php2shell-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T14:31:33Z","url":"https://github.com/mazdel/php2shell-poc"}],"tags":[]},{"url":"https://github.com/FarhadHosen101/PHP2Shell-CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"Advanced Pre-Auth RCE Exploit for PHP session.upload_progress (CVE-2026-109618 & 109619) by Farhad Hosen.","modified":"2026-10-22T19:40:24Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/FarhadHosen101/PHP2Shell-CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T19:40:24Z","url":"https://github.com/FarhadHosen101/PHP2Shell-CVE-2026-109619"}],"tags":[]},{"url":"https://github.com/WallcroftUK/CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T20:14:37Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/WallcroftUK/CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-22T20:14:37Z","url":"https://github.com/WallcroftUK/CVE-2026-109619"}],"tags":[]},{"url":"https://github.com/MorphingYU/CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"CVE-2026-109619 docker本地复现环境+Poc","modified":"2026-10-23T03:05:37Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/MorphingYU/CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-23T03:05:37Z","url":"https://github.com/MorphingYU/CVE-2026-109619"}],"tags":[]},{"url":"https://github.com/EQSTLab/CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"PHP2Shell","modified":"2026-10-25T00:28:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/EQSTLab/CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-25T00:28:05Z","url":"https://github.com/EQSTLab/CVE-2026-109619"}],"tags":[]},{"url":"https://github.com/DarynOngera/solid-palm-tree","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"CVE-2026-109619 / CVE-2026-109618 PoC","modified":"2026-10-23T18:28:10Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/DarynOngera/solid-palm-tree"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-23T18:28:10Z","url":"https://github.com/DarynOngera/solid-palm-tree"}],"tags":[]},{"url":"https://github.com/fellipgomes/br-php2shell","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"Descubra se sites da internet é vulnerável a php2shell CVE-2026-109619","modified":"2026-10-23T15:05:55Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/fellipgomes/br-php2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-23T15:05:55Z","url":"https://github.com/fellipgomes/br-php2shell"}],"tags":[]},{"url":"https://github.com/aarsaputra/php2shell","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design","modified":"2026-10-26T05:50:42Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/aarsaputra/php2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-26T05:50:42Z","url":"https://github.com/aarsaputra/php2shell"}],"tags":[]},{"url":"https://github.com/Taz1920/cve-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"CVE-2026-109619 PoC lab","modified":"2026-10-24T02:51:47Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/Taz1920/cve-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-24T02:51:47Z","url":"https://github.com/Taz1920/cve-2026-109619"}],"tags":[]},{"url":"https://github.com/abraxas/php-stale-global-uaf","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"PHP 8.5.11 - Critical - Remote - UAF - CVE-2026-109619 PHP2Shell. Same-worker fatal backtrace then INI diagnostic on Apache mod_php. Lab vs 8.5.12. Advisory RCE inferred.","modified":"2026-10-24T04:01:11Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/abraxas/php-stale-global-uaf"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-24T04:01:11Z","url":"https://github.com/abraxas/php-stale-global-uaf"}],"tags":[]},{"url":"https://github.com/franckferman/CVE-2026-109619","source":"poc-in-github","sourceId":"CVE-2026-109619","description":"CVE-2026-109619 - PHP session.upload_progress File Poisoning + LFI RCE (CVSS 9.2)","modified":"2026-10-26T01:55:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-109619","url":"https://github.com/franckferman/CVE-2026-109619"},{"source":"poc-in-github","sourceId":"CVE-2026-109619","modified":"2026-10-26T01:55:50Z","url":"https://github.com/franckferman/CVE-2026-109619"}],"tags":[]}],"test_commands":[{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-109619/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}]}