+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: PHP2Shell CVE-2026-109618 Full Exploit Source (/showthread.php?tid=6334403)
Pages: Pages
1
2
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - ▄︻デ══━一一一一━ - Oct 21, 2026
(32 hours ago)๖ۣۜLadon Kkc Wrote: Nobody got a working one ?
Working on it, might get some results and updates in some time.
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - Jаson - Oct 21, 2026
(32 hours ago)๖ۣۜLadon Kkc Wrote: Nobody got a working one ?
Yeah ,im working on this currently
fed the scripts into my local llm on LM-Studio
I will report back with my findings 😎😎😎
![[Image: IbvRPp3.png]](https://i.imgur.com/IbvRPp3.png)
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - Sift - Oct 22, 2026
(35 hours ago)rspower Wrote:
local works testing live targets now
Stop bullshitting lmao.
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - rspower - Oct 22, 2026
(29 hours ago)Sift Wrote: Stop bullshitting lmao.
I'm not bullshitting... I ran several tests with Qwen 3.8 Flash Uncensored on the Docker image and had the tests evaluated by Astra. I'm currently going through Shodan with some checked live targets, it has worked on 2 websites so far, but most of the time it fails because of the memory limit
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - Sift - Oct 22, 2026
(29 hours ago)rspower Wrote: I'm not bullshitting... I ran several tests with Qwen 3.8 Flash Uncensored on the Docker image and had the tests evaluated by Astra. I'm currently going through Shodan with some checked live targets, it has worked on 2 websites so far, but most of the time it fails because of the memory limit
You won’t achieve RCE chain on any live target unless there is another vulnerability that leaks memory addresses you have no idea what the vulnerability actually does.
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - ▄︻デ══━一一一一━ - Oct 22, 2026
https://calif.io/php2shell/
For everyone to understand basics.
/*************************************/
/* ▄︻デ══━一一一一━ */
/*************************************/
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - rspower - Oct 22, 2026
(28 hours ago)Sift Wrote: You won’t achieve RCE chain on any live target unless there is another vulnerability that leaks memory addresses you have no idea what the vulnerability actually does.
An ASLR bypass doesn't necessarily require a second, independent vuln. An leak can be part of the same exploit chain.
My current PHP2Shell implementation attempts to leak both the Zend MM heap base and the libphp base through corrupted session cookie data before constructing the RCE
Code
def libphp_base_from_cookie(raw: bytes, dtor_offset: int) -> int:
...
p = int.from_bytes(raw[8:16], "little")
...
base = p - dtor_offset
return base if base & 0xFFF == 0 else 0RE: PHP2Shell CVE-2026-109618 Full Exploit Source - Sift - Oct 22, 2026
(28 hours ago)rspower Wrote: An ASLR bypass doesn't necessarily require a second, independent vuln. An leak can be part of the same exploit chain.
My current PHP2Shell implementation attempts to leak both the Zend MM heap base and the libphp base through corrupted session cookie data before constructing the RCE
Codedef libphp_base_from_cookie(raw: bytes, dtor_offset: int) -> int:
...
p = int.from_bytes(raw[8:16], "little")
...
base = p - dtor_offset
return base if base & 0xFFF == 0 else 0
Doesn’t change the fact you still need the correct memory offsets for the ASLR bypass to do any good.