Strip repo to UAF RCE exploit only

Removed all exploits that require LFI or FPM access:
- cve-2026-109618/ (OOM + LFI)
- cve-2026-109619/ (session poisoning + LFI)
- session-deser/ (handler mismatch + deserialization chains)
- bypass/ (patch bypasses, all LFI-dependent)
- nolfi/ (served save_path + FPM pathinfo)
- fcgi/ (FastCGI auto_prepend_file)
- wordpress-exploit/ (LFI wrapper)
- wordpress/ (vulnerable plugin)

Moved the UAF RCE exploit (full ASLR bypass, no LFI, no FPM, no
framework) to the repository root. Rewrote README with exploit
details, usage, patch analysis, and test results. Cleaned .gitignore.

docker/apache-prefork.conf

@@ -0,0 +1,9 @@
+# Single-worker prefork for reliable exploitation.
+# The exploit requires A and B requests to hit the same worker.
+<IfModule mpm_prefork_module>
+    StartServers            1
+    MinSpareServers         1
+    MaxSpareServers         1
+    MaxRequestWorkers       1
+    MaxConnectionsPerChild  0
+</IfModule>

docker/docker-compose.yml

@@ -0,0 +1,21 @@
+services:
+  target:
+    image: php:8.4.26-apache
+    container_name: php2shell-uaf-target
+    ports:
+      - "127.0.0.1:8089:80"
+    volumes:
+      - ./php.ini:/usr/local/etc/php/php.ini:ro
+      - ./apache-prefork.conf:/etc/apache2/mods-available/mpm_prefork.conf:ro
+      - ./html:/var/www/html:rw
+    restart: unless-stopped
+
+  stock:
+    image: php:8.4.26-apache
+    container_name: php2shell-uaf-stock
+    ports:
+      - "127.0.0.1:8093:80"
+    volumes:
+      - ./apache-prefork.conf:/etc/apache2/mods-available/mpm_prefork.conf:ro
+      - ./html:/var/www/html:ro
+    restart: unless-stopped

docker/html/index.php

@@ -0,0 +1,3 @@
+<?php
+// Any PHP page works. session_start() is NOT required.
+echo "OK";

docker/php-deoff-8m.ini

@@ -0,0 +1,5 @@
+display_errors = Off
+memory_limit = 8M
+session.upload_progress.enabled = 1
+session.upload_progress.cleanup = 1
+max_input_vars = 1000

docker/php-deoff.ini

@@ -0,0 +1,5 @@
+display_errors = Off
+memory_limit = 128M
+session.upload_progress.enabled = 1
+session.upload_progress.cleanup = 1
+max_input_vars = 1000

docker/php.ini

@@ -0,0 +1,7 @@
+; Minimal config for the UAF RCE exploit lab.
+; Most settings match the stock php:8.4.26-apache defaults.
+display_errors = On
+memory_limit = 8M
+session.upload_progress.enabled = 1
+session.upload_progress.cleanup = 1
+max_input_vars = 1000