Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
php-rce — Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets | Kitploit
Tools/GitLabGitLab/david-alvarez-rosa/php-rce
Vulnerability AnalysisExploitationScripting & AutomationWeb Application ExploitationWeb SecurityPenetration TestingRemote Access Tool
GitLabdavid-alvarez-rosa/php-rce

php-rce

Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets

View Repository
113720h 38m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
  • PHP Remote Code Execution

Exploit for CVE-2026-109618 / CVE-2026-109619. Multiple exploits to achieve RCE on vulnerable PHP targets.

** Usage

#+begin_src sh $ uv sync $ uv run php-rce --url http://target/index.php --cmd "hostname" target: http://target/index.php cmd: hostname

trying session_lfi ... injecting session + scanning 56 LFI paths... found at attempt 23

vulnerable-hostname #+end_src

** Exploits

  • session_lfi :: session file inclusion
  • serialize_uaf :: serialize use-after-free
  • unserialize_uaf :: unserialize use-after-free
  • fast_fire :: race-condition based execution

They run sequentially, the first successful one runs the command.

Download Tool