david-alvarez-rosa /

php-rce

Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets

A new way for AI to search for data
View on GitHub
36GitHub stars

Python

What XERJ indexed

Snapshot

Whole repository

The whole repository at commit 9a8f61c87d.

Selected work

David Álvarez Rosa
@david-alvarez-rosa

“Add exploit chains for CVE-2026-109618/109619”. 9 files, 685 lines in exploits, the project root.

Licence

The repository

MIT

Checked by a person at the pinned commit.

The XERJ corpus

MIT, with credit

The author agreed by email on 2026-10-21. Same terms as the repository. Answers name the repo, the commit and the file:line.

in licence reviewnot in the hub yetsuggested use: adapt with attribution

cveexploitpenetration-testingphppythonrcesecurity

Example questions

The prompt

Paste it into your AI agent. It clones david-alvarez-rosa/php-rce at the pinned commit and indexes it on your machine.

Search the GitHub repository david-alvarez-rosa/php-rce with XERJ (https://hub.xerj.org/corpus/david-alvarez-rosa--php-rce).
Run these in a shell, in order, and check each result before the next:
1. xerj --help  (success: it prints usage). If xerj is missing: curl -fsSL https://xerj.org/get | sh
2. git clone https://github.com/david-alvarez-rosa/php-rce php-rce && git -C php-rce checkout 9a8f61c87dbc7b1e93aa87306052420a7a19a2d7
3. Start a local node and leave it running: xerj --insecure --data-dir ./xerj-data
4. xerj autoindex ./php-rce --url http://127.0.0.1:9200 --prefix php-rce --progress plain
5. xerj autoindex map --url http://127.0.0.1:9200
Then answer my question from the indexed files and cite the ax_path of every hit. Query syntax: https://xerj.org/llms.txt
Licence: MIT. Keep the copyright notice and credit the authors.

Related

David Álvarez RosaSecurity and vulnerabilities corporabandit-pluginspayloadsallthethingsavroAmz34/rekitargus-code-scanning/argus-codescan-mcpapache/magpie

Selected work and consent: the XERJ registry.