Python
aarsaputra/php2shell
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
★ 133
Stars
64 forks · 0 open issues
+3.3/day
Growth · measured
Stars counted between two of our own snapshots roughly a week apart. The repository page gives the exact span.
32.7
Momentum / 100
see the breakdown below
15d ago
Created
last push 9d ago
Star history
How this score was built
| Component | Weight | Earned | Why |
|---|---|---|---|
| Velocity | 55 | 12.1 | +3.3/day, log-scaled against a 750/day ceiling |
| Acceleration | 15 | 0.0 | needs 7-day and 30-day rates side by side |
| Freshness | 15 | 14.4 | last push 9d ago; decays to zero at 180 days |
| Scale | 15 | 6.2 | 133 stars, log-scaled against 150k — stops a 3-star repo topping the board |
| Momentum | 100 | 32.7 | sum of the above |
Detail
| Topics | cveexploitpenetration-testingphpphp2shellphp2shell-cvephp2shell-cve-2026php2shell-vulnerabilitypocrcerce-scannersecurityshellshell-backdoorvulnerability-research |
| Matched on | Security (security) |
| Short window | +23 stars over 7 days = 3.3/day |
| Long window | no snapshot 14–45 days old yet |
| Lifetime average | 10.29 stars/day over 13 days |
| First seen here | 2026-10-25 |
| Last read | 2d ago |