Critical Severity
CVE-2026-109619
Published: Oct 25, 2026
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
<div align="center">
<img src="gambar/screenshot_1.png" alt="php2shell in action" width="720">
# 💀 P H P 2 S H E L L
### Unauthenticated RCE chain for PHP 5.4 → 8.4.26
*Pure HTTP · zero target-side requirements · JA3 fingerprint impersonation · proof-of-access design*
[](https://www.php.net)
[](https://www.first.org/cvss/)
[](#-verification)
[](#-the-5-lab-requirements)
[](LICENSE)
[](#-one-command-lab)
[Install](#-install) · [Quick start](#-quick-start) · [Lab vs Live](#-lab-target-vs-live-target-baca-ini-sebelum-menjalankan) · [Modes](#-modes) · [Sumber repo](#-sumber-repo-bukan-fork-tapi-turunan-beberapa-repo) · [Kredit riset](#kredit-riset--siapa-menemukan-siapa-menuliskan) · [How it works](#-how-it-works) · [Stealth](#-stealth-anti-bot-detection) · [FAQ](#-faq) · [Disclaimer](#-disclaimer-authorized-use-only)
</div>
---
## ❖ What is this?
`php2shell` is a **reproduction and research toolkit** for two critical PHP
vulnerabilities — **CVE-2026-109619** and **CVE-2026-109618** (CVSS 4.0 **9.2
Critical**, unauthenticated, fixed in `8.2.35 / 8.3.36 / 8.4.27 / 8.5.12`).
It turns the bug into a **fully remote, HTTP-only exploit chain** against
`mod_php + Apache prefork` with **zero target-side requirements**:
- ❌ no `session_start()` needed on the target page
- ❌ no file upload feature needed
- ❌ no credentials, no cookie, no header trick
- ✅ the target page can be lit