High-visibility RCE index

Shell-capable vulns, tracked.

PHP2Shell, Node2Shell, React2Shell, and single-product RCEs. One public catalog. Shared page template. Structured data. Written for defenders and answer engines.

Pages: 01
KEV-listed: 00
Exploited: 00
Not fully patched: 01

Catalog

PHP2Shell
Two PHP core remote code execution bugs: CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state). PHP scores both CVSS 4.0 9.2. Exploitation attempts are widely reported; no authoritative source confirms a successful in-the-wild compromise as of 2026-10-23. Neither CVE is in CISA KEV (catalog 2026.10.21).
CVE-2026-109618 · CVE-2026-109619 · PHP2Shell · php2shell
Partly patchedExploitation attempts
Updated 2026-10-23

Email alerts

Email alerts coming soon

We’re not sending mail yet. Follow the catalog with RSS or the JSON feed.

RSS JSON feed