Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB. We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.

That’s cool! Nice work! How well does that work when sent via a reverse proxy and not via raw sockets? In my testing so far a proxy has broken every rce poc.

and if you have you are still vulnerable lol

for anyone who can't patch tonight, the interim setting vendors list for CVE-2026-109619 is session.upload_progress off, plus fatal_error_backtraces on 8.5. php's own line is still that updating is the only real fix

4 php branches (8.2 through 8.5) and 4 big apps from one chain. for shared hosts still stuck on 8.1 or older, does it work there too, or do the gadgets only exist in 8.2+?

This demo proves the exploits work, validating why the global response was so urgent. We actually covered the full scope of the situation.

The PHP advisory for CVE-2026-109618 said no complete FPM exploit had been demonstrated, only source analysis. Is this MediaWiki demo running on FPM? If so, "we're on FPM, not mod_php" stops being a reason to wait.

Four frameworks. One vulnerable runtime. Shell access. If every application passes its security tests while a shared dependency permits code execution, what exactly was certified? Who controls execution after the application boundary fails? CAN ⊬ MAY. ⚒️

Application assurance ≠ Dependency assurance ≠ Runtime containment. The exploit demonstrates a reported capability. The unresolved question is how far that capability can reach. CAN ⊬ MAY. ⚒