php-security

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

Some good resources for getting started with application security

Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), including Apache protections and PHP hardening guidance

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

Audit your PHP version for known CVEs and patches

An implementation of the FIDO U2F server protocol in PHP

Damn Vulnerable PHP Application (DVPA) - It is Lab Written in The PHP lang, Which Contains PHP Type Juggling - RCE Challenges

Sessions handler which stores session data in HMAC-signed and encrypted cookies

Lightweight, fast, and secure TOTP (2FA) authentication library for PHP — battle tested, dependency free, and ready for enterprise integration.

basics on making php applications secure

Secure Coding Practices for PHP – A white paper and code snippets on best practices for securing PHP applications, covering input validation, authentication, encryption, and more. 🔒🚀

Common security threats and standard best practice for php application development

🐘 PHP技巧

Blue-team PHP2Shell exposure triage: certificate-transparency subdomain discovery and disclosed PHP version checks.

This project is a personal learning, so you will find errors or disorganization

Profile Hanger | Authenticated Profile Upload Testing Tool for Ethical Cybersecurity Learning

Scan local PHP, Docker images, running containers, URLs and inventories for PHP2Shell exposure (CVE-2026-109618 / CVE-2026-109619). Zero-dependency Node CLI with terminal UI, HTML dashboard and GitHub Action. Read-only, no exploit code.

Automatic protection from Cross-Site Request Forgery.

A fast and secure by default content management system.