Root Access Club

php2shell – CVE-2026-109618 / CVE-2026-109619 (PoC) Two critical bugs in PHP core session upload progress mechanism causing a heap use-after-free (UAF) leading to arbitrary code execution (RCE) • Severity: Critical (CVSS v4.0: 9.2) 🚨 • Impacted Versions: PHP 5, 6, 7, and 8. Official patches are only coming for active PHP 8 branches, leaving EOL versions (5.x, 7.x, 8.0, 8.1) completely exposed🛡 The repository explains how to fix and mitigate it using WAF (ModSecurity) rules and Apache .htaccess configurations to block malicious requests before they even reach PHP 🟢 Github 🌐 ⚠️Disclaimer: Our channel is not responsible for any misuse of this information or tool ⭐️@RootAccessClub

PHP2Shell – Critical PHP Core RCE 🚨 CVE-2026-109618 / CVE-2026-109619 | CVSS 9.2 🫨 Two critical memory-safety flaws in PHP Core, reachable through session upload-progress handling, can lead to Remote Code Execution (RCE) on affected web servers 💣 Affected versions span PHP 5.4 → 8.5 🦠 🛡 Fix: Update PHP to the latest patched release for your branch (8.2+ officially supported) Sansec Advisory 🔗 💎 @RootAccessClub

Detect PHP powered websites & IPs using the updated php-detect nuclei template 💥 GitHub 🌐 @RootAccessClub

Reposted because of some spam bots flooding the last one, Let's keep it real⁩ 🤠 drop your reactions and show some support again⁩ ❤️‍🔥

❄️ SubZer0 – Noise in. Priority out Thousands of new CVEs every month Only a few actually matter — SubZer0 shows you which ones to patch first 🔴 KEV · EPSS · PoC · Metasploit · Nuclei — all in one view 🔐 SHA-256 verified · auto-refreshed every 6h ⚡️ Free · no sign-up · no tracking 🌐 iliya-bashrc.github.io/SubZer0 💻 github.com/iliya-bashrc/SubZer0 💎 @RootAccessClub × @BugCod3

Stop spamming fake views and reactions on the channel. Reactions are locked now. Don't waste your time

🚀 Gmail Creator Pro v2.1 — Bulk Gmail Account Creator Python tool with a slick terminal UI 🔥 ✅ Anti-detection & random user agents ✅ Phone verification bypass + 5sim API ✅ Proxy rotation ✅ Live stats & auto-save to JSON ✅ Auto-retry on failure ⚙️ Windows • Python 3.8+ • Chrome 🔗 GitHub ⚠️ Educational use only — violates Google ToS. 📢 @RootAccessClub

❄️ SubZer0 – Noise in. Priority out Thousands of new CVEs every month Only a few actually matter — SubZer0 shows you which ones to patch first 🔴 KEV · EPSS · PoC · Metasploit · Nuclei — all in one view 🔐 SHA-256 verified · auto-refreshed every 6h ⚡️ Free · no sign-up · no tracking 🌐 iliya-bashrc.github.io/SubZer0 💻 github.com/iliya-bashrc/SubZer0 💎 @RootAccessClub × @BugCod3

👀☄️

CVE-2025-29009 – WordPress Medical Prescription Attachment Plugin for WooCommerce Plugin ☢ Webkul Medical Prescription Attachment — Unrestricted File Upload → Web Shell 🔴 Affected : All versions ≤ 1.2.3 🆘 CVSS : 10 GitHub 🔗 🛡@RootAccessClub

CVE-2026-89079 – Theme My Login (WordPress multisite) 🧪 Security research tooling for CVE-2026-89079: unauthenticated account takeover on WordPress multisite when Theme My Login ≤ 7.2.1 has network option tml_user_passwords enabled 🧬 🟥 Affected : ≤ 7.2.1 🟩 Fixed : 7.2.2+ ♨️ CVSS : 9.8 (Critical) GitHub 🌐 🔰 @RootAccessClub

How to use Gemini CLI for Bug Bounty research: analyse evidence, validate manually 🫆 Read 📚 🪎 @RootAccessClub

CVE-2026-96889 – Next.js RCE 🫯 Nextjs GitHub GitHub GitHub ⚡️@RootAccessClub

Thanks fam 🫶 Massive thanks for the reactions and shares, Your support keeps this channel alive

🔹 pfSense Firewall 0day — 5 RCEs ▫️Exploit : 1⃣ Link 2⃣ Link 3⃣ Link 4⃣ Link 5⃣ Link ▪️Writeups : 1⃣ Link 2⃣ Link 3⃣ Link 4⃣ Link 5⃣ Link ⚠️ For educational and authorized security research purposes only 🆒 @RootAccessClub

SSRF ☄ payload: [](http://metadata+url) 🌊 @RootAccessClub

Claude Kit 🛡️ A powerful open-source toolkit for bug bounty hunters, built to improve vulnerability reporting with Claude Code 🤖 Write better reports. Validate findings. Avoid common mistakes ⚡ GitHub 🌐 @RootAccessClub ⭐️

Toxssin – An XSS exploitation command line interface and payload generator 🫯 toxssin is an open source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js) 🦠 GitHub 🌐 💎 @RootAccessClub

Open redirects filter bypass payloads 💥 ---->\/evil.com ---->\/\/evil.com ---->\\evil.com ----//evil.com ---->//theirsite@evil.com ---->////evil.com ----//google%E3%80%82com ---->//%2F/evil.com ---->////evil.com ---->/%2F/yoururl.com 🪎 @RootAccessClub

SubZer0 👀❄️