CVE-2026-109618

Community PoC source and mitigation examples for PHP, Apache, Cloudflare, FrankenPHP and lighttpd. The reviewed snapshot contains poc_109618.py despite the README's older coming-soon notice.

Source inspected and Python syntax checked; exploit not executed. The script depends on build-specific addresses. Its presence does not establish reliable exploitation across PHP deployments.

Session-file injection and serializer-mismatch verification scripts, a deserialization UAF reproducer, and research notes. The described RCE chains require additional conditions such as application LFI, unsafe deserialization or a usable gadget.

Source inspected; scripts not executed. The lab generator uses a floating PHP image, publishes HTTP and FastCGI on all interfaces, and enables privileged mode with seccomp disabled. Review and isolate it before use; the supplied setup is not a safe localhost-only recipe.

Research bundle with claimed exploit implementations, a framework and validation notes. The repository credits J4ck3LSyN, Andrew Dorman and Arch&Yuki; reproduction claims remain attributed to its authors.

Source inspected; nothing executed. All four Python files in this reviewed snapshot fail syntax parsing at line 1 because uncommented prose precedes the shebang. The README also refers to directories absent from the snapshot. This is not a verified runnable package. Historical review: the public repository returned HTTP 404 on 24 October 2026 and is currently unavailable; the pinned links may no longer resolve.

Upload/session research lab with pinned PHP images, nginx/FPM targets, a WordPress example and an AddressSanitizer build scaffold. Useful for controlled observation and build comparisons.

Source reviewed, not executed. The harness does not return a reliable vulnerability verdict; normal progress metadata is not proof of either CVE. Top-level port bindings require loopback correction. The separate impact payload assumes code execution rather than demonstrating how to obtain it.

Apache prefork exploit research for the original PHP2Shell flaws, with x86_64 and aarch64 profiles and published author run logs. The current production-INI path differs from its archived 8M/display-errors-on experiments.

Source inspected; not executed. Build-specific profiles remain necessary. The driver holds most worker slots and sends memory-intensive requests, so it can disrupt a service. Its local success check depends on a proof file shared with the supplied container; author success rates are not independent validation.

Local Docker trigger labs for multipart memory exhaustion and stale fatal-error state. The trigger scripts report HTTP responses, worker identity and follow-up health; they do not attempt controlled code execution.

Source inspected; not executed. An OOM, disconnect or healthy follow-up is not a reliable CVE verdict. The stale-state control disables the relevant setting on the same vulnerable build; it is not a matched patched-build comparison. Its separate ASLR lab wraps 9bie's code and is not an independent exploit.

Comparative research with an author-reported server/build matrix, production-INI and legacy Apache chains, and separate application-dependent session/deserialization examples.

Selected source inspected; not executed. The published matrix is the author's evidence, not independent validation. Current profiles are build-specific. The reviewed pure_off.py returns success after sending OOB attempts without checking receipt; a zero exit code in that mode is not proof of command execution.

Research collection with an explicitly graded multipart-parser screening tool. The reviewed screening path separates banner observations, surface exposure, front-end filtering and parser OOM evidence.

Only selected screening source and documentation inspected; nothing executed. Default tier 1 sends an active multipart request and reports INCONCLUSIVE. Higher tiers can terminate workers. NO_SIGNAL and an exit code of zero do not establish that a host is safe or patched.