This module exploits CVE-2026-109618, a use-after-free vulnerability in PHP's multipart upload-progress/session handling. When PHP reaches memory_limit during specially structured multipart processing, an abnormal bailout can leave session-related Zend objects dangling in a persistent Apache worker. A later request handled by that same worker can reuse the freed memory, turning the stale references into memory disclosure and, ultimately, code execution, to deploy an OSCI agent. The module first occupies 255 of Apache's 256 prefork workers, forcing every stage onto the same remaining process. Its A1 request triggers the faulty out-of-memory cleanup, and B1 reclaims the stale session identifier with a forged string. Reading that string beyond its legitimate bounds leaks heap and libphp pointers, allowing the module to calculate the heap base, libphp base, and address of PHP's internal zif_system function despite ASLR. A second out-of-memory request, A2, creates another dangling session reference. B2 then sprays the corresponding allocation class with forged zend_reference, zend_array, zend_execute_data, and zend_string objects. The fake array's destructor points to zif_system, while its fabricated call frame supplies the user's command as the function argument. When PHP destroys the reclaimed object, it follows the forged destructor and invokes system(command). The command is stored in the unused tail of a 384-byte heap carrier; after the required structures and NUL terminator, this provides a validated maximum of 231 command bytes. The chain is layout-specific and was calibrated for the controlled PHP 8.4.26 Apache-prefork environment.

This module exploits CVE-2026-109618, a use-after-free vulnerability in PHP's multipart upload-progress/session handling. When PHP reaches memory_limit during specially structured multipart processing, an abnormal bailout can leave session-related Zend objects dangling in a persistent Apache worker. A later request handled by that same worker can reuse the freed memory, turning the stale references into memory disclosure and, ultimately, code execution, to deploy an OSCI agent. The module first occupies 255 of Apache's 256 prefork workers, forcing every stage onto the same remaining process. Its A1 request triggers the faulty out-of-memory cleanup, and B1 reclaims the stale session identifier with a forged string. Reading that string beyond its legitimate bounds leaks heap and libphp pointers, allowing the module to calculate the heap base, libphp base, and address of PHP's internal zif_system function despite ASLR. A second out-of-memory request, A2, creates another dangling session reference. B2 then sprays the corresponding allocation class with forged zend_reference, zend_array, zend_execute_data, and zend_string objects. The fake array's destructor points to zif_system, while its fabricated call frame supplies the user's command as the function argument. When PHP destroys the reclaimed object, it follows the forged destructor and invokes system(command). The command is stored in the unused tail of a 384-byte heap carrier; after the required structures and NUL terminator, this provides a validated maximum of 231 command bytes. The chain is layout-specific and was calibrated for the controlled PHP 8.4.26 Apache-prefork environment.

CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.

CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.

This module remotely exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.

This module exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.

This module exploits CVE-2026-59310, a directory traversal vulnerability in the Syslog server component of VMware vCenter Server to deploy an Core Impact OSCI agent. The module will use the vulnerability to create a log file inside the /opt/vmware/share/htdocs/configurev2/ directory and then verify the result via a HTTP GET request to the /configurev2 endpoint via the 5480 port with a random filename terminated in the "-syslog.log" string. Then, the module will try to erase the created log file by using the vulnerability again to create a cron file inside the /etc/cron.d/ directory. The cron job will autodelete itself. If the target is vulnerable, the module will deploy an Core Impact OSCI agent with capabilities to execute commands as root. Due to the way the vulnerability is exploited, no command output is possible, so Core Impact OSCI agent terminal commands will be marked as blind.

CVE-2026-48908 affects JoomShaper SP Page Builder versions 6.6.1 and earlier. The asset.uploadCustomIcon task accepts an icon-font ZIP without authentication or a CSRF token. The module sends a valid multipart icon-font package in the custom_icon field. The vulnerable component extracts the archive below media/com_sppagebuilder/assets/iconfont/name/, a location normally served by the Joomla web server. The archive contains a randomly named, token-guarded PHP file in the fonts directory. The module first requests that file with a harmless marker to distinguish file write from server-side PHP execution. It then uses the same endpoint to deliver the selected Linux Impact agent. Successful execution depends on the target web server allowing PHP execution for the extracted media directory. If the upload succeeds but PHP is not executed there, the target is file-write vulnerable but is not confirmed as remote code execution by this module. The agent runs with the privileges of the Joomla/PHP service account, commonly www-data on Linux Apache deployments. No administrator credentials are required.

CVE-2026-48908 affects JoomShaper SP Page Builder versions 6.6.1 and earlier. The asset.uploadCustomIcon task accepts an icon-font ZIP without requiring authentication or a CSRF token. The module sends a valid multipart icon-font package in the custom_icon field. The vulnerable component extracts the archive below media/com_sppagebuilder/assets/iconfont/name/, a location normally served by the Joomla web server. The archive contains a randomly named, token-guarded PHP file in the fonts directory. The module first requests that file with a harmless marker to distinguish file write from server-side PHP execution. It then uses the same endpoint to deliver the selected Linux Impact agent. Successful execution depends on the target web server allowing PHP execution for the extracted media directory. If the upload succeeds but PHP is not executed there, the target is file-write vulnerable but is not confirmed as remote code execution by this module. The agent runs with the privileges of the Joomla/PHP service account, commonly www-data on Linux Apache deployments. No administrator credentials are required. Linux agent delivery uses curl because standard Joomla PHP/Apache images commonly include curl without wget. The selected Impact web server must be reachable from the target container.

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.