# vuln2shell

> Public index of high-visibility vulnerabilities that get attackers a shell: PHP2Shell, Node2Shell, React2Shell, and single-product RCEs. For defenders tracking patch status, exploitation, and vendor response.

This site is a public catalog of high-visibility vulnerabilities that can get an attacker a shell. No exploit code is published here.

## Catalog

- [PHP2Shell (CVE-2026-109618 / CVE-2026-109619)](https://vuln2shell.com/vulns/php2shell): Two PHP core remote code execution bugs: CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state). PHP scores both CVSS 4.0 9.2. Exploitation attempts are widely reported; no authoritative source confirms a successful in-the-wild compromise as of 2026-10-23. Neither CVE is in CISA KEV (catalog 2026.10.21).

## Feeds

- [RSS](https://vuln2shell.com/rss.xml)
- [JSON Feed](https://vuln2shell.com/feed.json)
- [llms.txt](https://vuln2shell.com/llms.txt)

## Privacy

- [Privacy](https://vuln2shell.com/privacy): email alerts store only the address and subscription scope.