#php
8
2026-10-22
dinosn/php-cve-2026-10961x-lab-poc
B
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
2026-10-23
Show HN: Php2ShellCheck – Python script that checks for vuln indicators
unrated
Hi All. A coworker and I (and AI) built this python script that checks HTTP response headers for indicators that the site is using a version of PHP that's vulnerable to PHP2Shell (CVE-2026-109618, CVE-2026-109619). It's an asynchronous HTTP/HTTPS header inspection tool that fingerprints PHP and compares the version against the PHP2Shell fixed releases. Obviously this isn't a foolproof way of knowing if a host is vulnerable (See Security disclaimer in README.md), but it's at least good at finding hosts in your environment that are advertising to the internet that they are using a vulnerable version of PHP. My first time submitting to HN - please be merciful. Now accepting feedback, suggestions, and constructive criticism.
2026-08-29
Code Quality Checker Tools For PHP Projects
unrated
A collection of PHP linters in github collections