When I saw a new critical PHP vulnerability PHP2Shell (CVE-2026-109618) with CVSS 10.0 allowing RCE via EXIF headers, I knew many shared hosting servers in Pakistan would remain unpatched.
So I built php2shell-fix-toolkit - an emergency open-source toolkit.
What is PHP2Shell?
It's a critical RCE vulnerability in PHP's EXIF parsing. Attackers can upload an image with malicious EXIF data and get remote code execution. CVSS 10.0
What my toolkit does:
- Non-destructive scanner for php2shell
- Instant mitigation (.htaccess / http://php.ini patch)
- Verification mode
- Works on cPanel / Shared Hosting with no root needed
GitHub: https://github.com/farimazhar/php2shell-fix-toolkit
How to use:
git clone https://github.com/farimazhar/php2shell-fix-toolkit
cd php2shell-fix-toolkit
./scan.sh /var/www/html
./fix.sh --apply
I made this because cybersecurity tools should be accessible for everyone, not just enterprises.
Built with love from Islamabad, Pakistan.
I am open to work for Cybersecurity / PHP Security / Bug Bounty roles.
Contact: farimazhar101@gmail.com
Top comments (0)