Is your PHP patched against PHP2Shell?
php-vuln-check is a free, open-source PHP2Shell checker. It audits your servers, Docker images and CI pipelines, understands distro backports, and never sends exploit traffic.
Check your PHP in 10 seconds
pipx install git+https://github.com/ethoic-inc/php-vuln-check
php-vuln-check # audit PHP on this server
php-vuln-check images . # audit Dockerfiles, compose files, Kubernetes manifestsVULNERABLE php:8.3.35-fpm-alpine
8.3.35 is below the fixed release 8.3.36
REVIEW php:8.3-cli
floating tag: pin it to 8.3.36 or later and rebuild with --pull
PATCHED php:8.4.27-apache
8.4.27 is the fixed releaseWhich PHP versions fix PHP2Shell?
PHP2Shell is two critical remote code execution bugs in the PHP engine (CVSS 9.2) that need no login. They affect unpatched PHP back to 5.4 serving web requests, mainly Apache mod_php and PHP-FPM.
| PHP branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | no upstream release: use a vendor backport or upgrade |
What it checks
Servers
Every PHP CLI, FPM, CGI and Apache mod_php install, its version and its package changelog.
Docker and Kubernetes
FROM lines, compose files and manifests, with the file and line number.
Whole fleets
Run it on every host over SSH. Nothing is installed on them.
CI pipelines
A GitHub Action and SARIF output put findings in your Security tab.
Frequently asked questions
How do I check if my server is vulnerable to PHP2Shell?
Run php-vuln-check on the server. VULNERABLE means the PHP there is below the fix and has no vendor backport. PATCHED means the version is fixed or the vendor changelog names both CVEs.
Does Debian, Ubuntu or RHEL ship a fixed PHP?
Often as a backport on an older version number, so PHP 8.2.30 on a distro can be safe. The checker reads the package changelog for both CVE IDs before calling a host patched.
Is PHP 7.4 or 8.1 vulnerable to CVE-2026-109618?
Yes unless your vendor shipped a backport. Those branches are end-of-life and have no upstream fix.
Will the checker crash my server?
No. It sends no exploit traffic. On a server it reads files and runs php -n -v and php -i; --no-exec skips even that.
How is this different from other PHP2Shell scanners?
Active scanners probe a host by deliberately triggering PHP memory exhaustion. php-vuln-check reads versions, changelogs and config instead, so it is safe on production and covers images, pipelines and whole fleets. Use both.