Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Party
Community detection authors (darkfibr, rjmendez, Lexsah, Blevene)
the rules, and the correction of the leaked PoC's mechanism
Claims this site attributes to this party
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechanism; a lab reproduction of the leaked PoC's precondition produced a clean 200 The Hacker News says the same of the public code. Fastly: working RCE needs knowledge of the running binary's layout on x86_64. fact timeline → | rjmendez (detection author) citing VulnCheck; Huntress | reported | A1 Weak signal●○○○○○ status overstated | 1/2 | rjmendez, GitHub Huntress |
Its sources in the vault
- GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub darkfibr (Mike Haddock), GitHub
- GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub rjmendez, GitHub
- GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub Lexsah, GitHub
- PHP2Shell: Detection Opportunities · GitHub Blevene (GitHub gist)