CVE-2026-109618 CVE-2026-109619 CVSS 9.2 Free & Open Source

Is your server vulnerable to PHP2Shell?

A free, open-source scanner that checks whether your PHP is affected by CVE-2026-109618 and CVE-2026-109619 — two critical, unauthenticated remote code execution bugs in PHP core. Works even when the PHP version is hidden.

View on GitHub → Quick start

What is PHP2Shell?

The pair of bugs the whole PHP ecosystem patched on 21 October 2026.

CVE-2026-109618CVE-2026-109619
TypeOut-of-memory memory corruptionUse-after-free
SeverityCVSS v4.0 9.2CVSS v4.0 9.2
Auth requiredNoneNone
Fixed inPHP 8.2.35, 8.3.36, 8.4.27, 8.5.12

Both bugs live in PHP core itself — not in any application running on top of it. That means login pages, WAF rules and .htaccess deny-lists don't help, since PHP processes the request before any application code runs. It's affected every PHP install from 5.4.0 up to the fixed releases; 7.4, 8.0 and 8.1 only received source backports, not official releases.

What the scanner does

No account, no install beyond Python. GUI and command line, both free.

php2shell-scanner results table showing a mix of VULNERABLE, INDETERMINATE and PATCHED hosts
Scan results: verdict, basis, confidence and detected stack per host.
Fingerprints the stackWeb server, PHP, CMS, framework, CDN/WAF — ~5,800 technology signatures plus ~70 built-in checks.
Grades the PHP versionAgainst the real fixed-release table, with backport awareness for Ubuntu, Debian, RHEL-family and deb.sury.org builds.
Settles hidden versionsAn opt-in active patch oracle reads PHP's own behavior — never triggers the actual bug.
Writes real evidenceA Markdown report with the exact request, response, and a curl to reproduce it.
A row expanded: host discloses no PHP version at all, yet the active oracle confirms VULNERABLE with high confidence
No PHP version disclosed here, yet the active oracle still confirms VULNERABLE.

Quick start

One-click setup, whatever Python you already have (3.8+, or it'll help you get there).

git clone https://github.com/kunshdeep2812/php2shell-scanner.git
cd php2shell-scanner
python3 setup.py

Then either open the GUI (python3 scanner.py) or scan from the command line:

python3 scanner.py --cli --authorized -t yourdomain.com --deep --oracle

Full docs, options, and safety notes are in the README.

FAQ

What is PHP2Shell?
PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote code execution vulnerabilities in PHP core (CVSS v4.0 9.2), disclosed and patched on 21 October 2026.
Is my PHP server vulnerable to PHP2Shell?
If your PHP version is below the first fixed release for its branch — 8.2.35, 8.3.36, 8.4.27, or 8.5.12 — yes. If the version is hidden, this scanner's active patch oracle can still settle it without exploiting anything.
How do I check if I'm affected by CVE-2026-109618 or CVE-2026-109619?
Run php -v or your package manager on the host, or point php2shell-scanner at the site: python3 scanner.py --cli --authorized -t yourdomain.com --deep --oracle
Is PHP2Shell actually being exploited in the wild?
Yes — multiple vendors including Amazon, watchTowr, Cloudflare, and Hadrian reported active exploitation, including attempts observed before the public patch shipped.
How do I fix CVE-2026-109618 and CVE-2026-109619?
Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or your distro's equivalent patched package) and restart every PHP worker.
Does php2shell-scanner actually exploit the vulnerability?
No. It never triggers the memory-corruption bug. Verdicts come from the PHP version and, optionally, a harmless behavioral check — never from a working exploit.
Is php2shell-scanner free?
Yes — MIT licensed, open source, no account or API key needed.