php-security

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

Some good resources for getting started with application security

PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance for authorized security testing.

Audit your PHP version for known CVEs and patches

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

Emergency Apache mitigation and testing toolkit for php2shell (CVE-2026-109618 / CVE-2026-109619), featuring multipart POST blocking, request-size limits, and additional hardening measures.

An implementation of the FIDO U2F server protocol in PHP

Damn Vulnerable PHP Application (DVPA) - It is Lab Written in The PHP lang, Which Contains PHP Type Juggling - RCE Challenges

Sessions handler which stores session data in HMAC-signed and encrypted cookies

Lightweight, fast, and secure TOTP (2FA) authentication library for PHP — battle tested, dependency free, and ready for enterprise integration.

basics on making php applications secure

Secure Coding Practices for PHP – A white paper and code snippets on best practices for securing PHP applications, covering input validation, authentication, encryption, and more. 🔒🚀

Common security threats and standard best practice for php application development

🐘 PHP技巧

This project is a personal learning, so you will find errors or disorganization

Profile Hanger | Authenticated Profile Upload Testing Tool for Ethical Cybersecurity Learning

Automatic protection from Cross-Site Request Forgery.

A fast and secure by default content management system.

🔍Find potential vulnerable/exploitable PHP functions in PHP projects automatically!

Obfuscate and protect your PHP source code with a multi-layered encoding tool — secure your scripts from being edited, copied, or reverse engineered.