Boost global trust with ISO 27001 Certification
Get a Quote
RESEARCH & DISCLOSURE DESK

Zero-Day Vulnerability Research & Advisories

Original vulnerability research, verified offensive discoveries, and coordinated disclosures by the Femto Security Vulnerability Research Team.

Coordinated Disclosure
Offensive Vulnerability Research
Responsible Remediation

Published Security Research

Analysis of php2shell Remote Code Execution Zero-Day Vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619)
PHP

Analysis of PHP2Shell Remote Code Execution Zero-Day Vulnerabilities in PHP (Full PoC)

October 21, 2026 · PHP

Analysis of the php2shell zero-day flaws in PHP reveals unauthenticated remote code execution via out-of-memory handling and worker state reuse.

Zero-Day
Read research
signageOS Unauthenticated Zero-Day Command Injection in Box Console Package Upload
signageOS

signageOS Zero-Day: Unauthenticated Command Injection

September 10, 2026 · signageOS

Femto Security identified an unauthenticated zero-day command injection flaw in the signageOS Box package upload endpoint yielding remote code execution.

Zero-Day
Read research
  • Talk to an Expert
    >