Introduction #
Short introduction, summed up by AI.
What happened? Security researchers disclosed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) affecting the PHP interpreter itself – not WordPress or any specific application. PHP versions prior to the security releases from October 21, 2026 are affected.
The vulnerabilities in detail:
- CVE-2026-109618 allows an internal memory pointer to be overwritten, enabling arbitrary code execution – a shell – on the server. It was already being exploited in the wild before the patch was released.
- CVE-2026-109619 allows an attacker to bypass memory protections and achieve code execution through a crafted request.
Both can be exploited remotely without authentication via manipulated HTTP requests. That’s what makes them so dangerous – every PHP application processing requests is a potential entry point.
Who is affected? Practically every PHP installation processing web requests on unpatched versions
- patched: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
- End-of-Life, permanently vulnerable: PHP ≤ 8.1
End of the AI summary.
Post from the german BSI: BSI - Version 1.1: PHP - Kritische Schwachstellen bedrohen Webanwendungen weltweit
How can I scan my services #
IMPORTANT: Use this scanner ONLY on websites you are allowed to scan! The scanner uses a complete exploit framework!
The README section “Scope / ethics” claims:
Defaults are polite enough for production
In reality, however, the repo contains:
- Documentation for real attacks against government servers
- Pre-fabricated deface pages
- Complete RCE exploit logic
- An automatic PoC downloader
This Project on Github enables you to scan your URL for the CVEs: 0xrsydn/php2shell-scan
Verdicts from the offical Github Repository:
- mitigated: multipart rejected at the edge (403) — not fixed, just unreachable
- exposed: PHP parses attacker multipart pre-auth: the CVE surface is live
- inconclusive: PHP unconfirmed, or the pool hangs under the probe
- improved: worker deaths vanished vs baseline — a patch smell, confirm with php -v
- changed: failure rate moved ≥10 pp on some case — look before concluding
- unchanged: identical to baseline; still vulnerable
- no_signal: flat and deathless both runs — corroboration only, never proof
Installation #
pipx install git+https://github.com/0xrsydn/php2shell-scan
# or
git clone https://github.com/0xrsydn/php2shell-scan && python3 -m php2shell_scan probe https://host/
Change the “https://host/” to your URL. More informations can be gathered from the Github Repository
Scan for attacks #
The Github Repository https://github.com/darkfibr/php2shell-detect allows you to scan your logs and folders for existing attacks. Not tested by myself!
