I Built an Emergency Toolkit for PHP2Shell RCE (CVE-2026-109618) - From Pakistan

farimazhar — Fri, 23 Oct 2026 07:22:08 +0000

When I saw a new critical PHP vulnerability PHP2Shell (CVE-2026-109618) with CVSS 10.0 allowing RCE via EXIF headers, I knew many shared hosting servers in Pakistan would remain unpatched.

So I built php2shell-fix-toolkit - an emergency open-source toolkit.

What is PHP2Shell?
It's a critical RCE vulnerability in PHP's EXIF parsing. Attackers can upload an image with malicious EXIF data and get remote code execution. CVSS 10.0

What my toolkit does:

Non-destructive scanner for php2shell
Instant mitigation (.htaccess / http://php.ini patch)
Verification mode
Works on cPanel / Shared Hosting with no root needed

GitHub: https://github.com/farimazhar/php2shell-fix-toolkit

How to use:
git clone https://github.com/farimazhar/php2shell-fix-toolkit
cd php2shell-fix-toolkit
./scan.sh /var/www/html
./fix.sh --apply

I made this because cybersecurity tools should be accessible for everyone, not just enterprises.

Built with love from Islamabad, Pakistan.

I am open to work for Cybersecurity / PHP Security / Bug Bounty roles.

Contact: farimazhar101@gmail.com

DEV Community: farimazhar

I Built an Emergency Toolkit for PHP2Shell RCE (CVE-2026-109618) - From Pakistan