This repository is a defender lab. It contains no exploit code and must stay that way: pull requests that add payloads, proof-of-concept exploits or scanners aimed at systems you don't own will be closed.

If you find a problem in the lab itself (for example, something that exposes a port beyond 127.0.0.1), open a private report through GitHub's "Report a vulnerability" button on the Security tab.

For the PHP vulnerabilities themselves, follow PHP's advisories and your operating system vendor; this lab cannot fix your servers for you.