CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

exploit poc rce php-security wordpress-security detection-rules vulnerability-research suricata-rules waf-rules php-exploit session-upload-progress cve-2026-109618 cve-2026-109619 php2shell

• Updated Oct 28, 2026
• Python

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

php exploit apache penetration-testing poc rce bug-bounty php-security cve mod-php red-team security-research exploit-development vulnerability-research heap-exploitation php-exploit pre-auth-rce session-upload-progress cve-2026-109618 cve-2026-109619

• Updated Oct 30, 2026
• Python

Some good resources for getting started with application security

owasp infosec application-security ctf php-security appsec infosec-reference web-hacking websecurity security-engineering websec websecurity-reference appsec-tutorials

• Updated Jun 2, 2021

Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), including Apache protections and PHP hardening guidance

php apache patches cybersecurity application-security php-security appsec mitigation defenses

• Updated Oct 24, 2026
• PHP

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

php security rce php-security cve vulnerability-scanner subfinder crtsh cve-2026-109618 cve-2026-109619

• Updated Oct 21, 2026
• Python

Audit your PHP version for known CVEs and patches

php security security-audit php-library docker-image audit php-security hacktoberfest security-scanner composer-package cves

• Updated Aug 20, 2025
• PHP

An implementation of the FIDO U2F server protocol in PHP

php fido-u2f fido u2f-protocol u2f-server u2f-php php-security

• Updated Mar 25, 2024
• PHP

Damn Vulnerable PHP Application (DVPA) - It is Lab Written in The PHP lang, Which Contains PHP Type Juggling - RCE Challenges

white-box-testing code-review php-security blue-team code-audit source-code-audit

• Updated May 18, 2022
• PHP

Sessions handler which stores session data in HMAC-signed and encrypted cookies

php jwt encryption sessions sessionstorage jwt-token hmac php-security jwt-authentication session-handler jwt-middleware sessionstore php-sessions sessionservice encrypted-cookies php-storageless-sessions hmac-signature

• Updated Sep 30, 2025
• PHP

Lightweight, fast, and secure TOTP (2FA) authentication library for PHP — battle tested, dependency free, and ready for enterprise integration.

web-security php-security 2fa otp-generator otp-library api-security 2factor 2fa-security one-time-password otp-verification totp-generator time-based-otp totp-authenticator php-2fa

• Updated Nov 7, 2026
• PHP

basics on making php applications secure

php errors sql-injection php-security ssl-certificates xsrf xss-attacks exposing-directories

• Updated May 20, 2026
• PHP

Secure Coding Practices for PHP – A white paper and code snippets on best practices for securing PHP applications, covering input validation, authentication, encryption, and more. 🔒🚀

php php7 best-practices cybersecurity php-security cyber-security secure-coding php8 cyber-threats php-cybersecurity secure-web-apps secure-php

• Updated Apr 9, 2024
• PHP

Common security threats and standard best practice for php application development

php xss owasp session-management sql-injection php-security php-best-practices security-threats preventive-measures session-attack

• Updated Mar 10, 2020
• PHP

🐘 PHP技巧

php-mysql php-security guzzlehttp document-fragment php-async php-search php-programming cache-aside php-redis

• Updated Oct 25, 2019
• PHP

Blue-team PHP2Shell exposure triage: certificate-transparency subdomain discovery and disclosed PHP version checks.

nodejs php certificate-transparency php-security security-tools blue-team crt-sh subdomain-enumeration exposure-management attack-surface-management php2shell shodan-ctl

• Updated Oct 25, 2026
• JavaScript

This project is a personal learning, so you will find errors or disorganization

php php-security webapplication webapplications web-application-security-with-php

• Updated Apr 10, 2024
• PHP

Profile Hanger | Authenticated Profile Upload Testing Tool for Ethical Cybersecurity Learning

python file-upload cybersecurity web-security php-security ethical-hacking hacking-lab security-tool profile-changer profile-upload authenticated-upload profile-hange

• Updated Feb 26, 2026
• Python

Scan local PHP, Docker images, running containers, URLs and inventories for PHP2Shell exposure (CVE-2026-109618 / CVE-2026-109619). Zero-dependency Node CLI with terminal UI, HTML dashboard and GitHub Action. Read-only, no exploit code.

nodejs docker cli php security incident-response rce php-security cve security-tools devsecops vulnerability-scanner container-security github-actions cve-2026-109618 cve-2026-109619 php2shell

• Updated Oct 22, 2026
• JavaScript

Automatic protection from Cross-Site Request Forgery.

security csrf php-security csrf-protector csrf-protection csrf-tokens automatic-protection phpgt no-ai

• Updated Nov 6, 2026
• PHP

A fast and secure by default content management system.

controllers routing user-management secure-by-default php-security login-system php-di user-registration libsodium-php secure-coding php-project encrypted-cookies php7-2 php7-1 php7-0 php-dispatching ext-sodium

• Updated Feb 6, 2018
• PHP