php-security

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance for authorized security testing.

Some good resources for getting started with application security

Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), including Apache protections and PHP hardening guidance

Audit your PHP version for known CVEs and patches

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

An implementation of the FIDO U2F server protocol in PHP

Damn Vulnerable PHP Application (DVPA) - It is Lab Written in The PHP lang, Which Contains PHP Type Juggling - RCE Challenges

Sessions handler which stores session data in HMAC-signed and encrypted cookies

Lightweight, fast, and secure TOTP (2FA) authentication library for PHP — battle tested, dependency free, and ready for enterprise integration.

basics on making php applications secure

Secure Coding Practices for PHP – A white paper and code snippets on best practices for securing PHP applications, covering input validation, authentication, encryption, and more. 🔒🚀

Common security threats and standard best practice for php application development

🐘 PHP技巧

Blue-team PHP2Shell exposure triage: certificate-transparency subdomain discovery and disclosed PHP version checks.

This project is a personal learning, so you will find errors or disorganization

Profile Hanger | Authenticated Profile Upload Testing Tool for Ethical Cybersecurity Learning

Scan local PHP, Docker images, running containers, URLs and inventories for PHP2Shell exposure (CVE-2026-109618 / CVE-2026-109619). Zero-dependency Node CLI with terminal UI, HTML dashboard and GitHub Action. Read-only, no exploit code.

Automatic protection from Cross-Site Request Forgery.

A fast and secure by default content management system.