PHP2Shell

Research and exploitation toolkit for the pre-authentication RCE in PHP's session.upload_progress handling (CVE-2026-109618 / CVE-2026-109619). It ships version-aware exploit profiles, reproducible Docker laboratories, heap calibration and runtime instrumentation for the mod_php and PHP-FPM variants, with detection guidance for defenders.