Exploit for Improperly Controlled Sequential Memory Allocation in Php

All-in-one, **read-only** local checker for the PHP vulnerabilities known as *PHP2Shell*

(CVE-2026-109618 / CVE-2026-109619, unauthenticated remote code execution, fixed in PHP

8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026).

One Python file, standard library only, Python 3.6+, Linux. It changes nothing and sends nothing

over the network. While it runs it explains in English what each step does and what it looks for,

so the output doubles as a record of what was verified.

> **Not an official tool.** There are no official IOCs for these CVEs. The log and file heuristics

> come from public write-ups and can produce false positives and miss real attacks. A log hit is an

> attempt, not proof of compromise. *No findings does not prove the host was not attacked.*

sudo python3 php2shell_check.py # everything, from 2026-10-17

sudo python3 php2shell_check.py --since 17.10.2026 --json report.json

sudo python3 php2shell_check.py --webroot /srv/app --access-log '/data/logs/*.log*'

sudo python3 php2shell_check.py --quiet # final report only

Run it as root, otherwise logs, other users' processes and many files are unreadable (the script warns).

Exit code: `2` at least one HIGH finding, `1` at least one MEDIUM, `0` otherwise.

| **Supported** | Linux (Debian/Ubuntu, RHEL/Alma/Rocky/CentOS/Fedora/Amazon Linux, SUSE) on bare metal, VM or LXC, and *inside* a Docker/Podman container. nginx, Apache (mod_php), LiteSpeed, Caddy, lighttpd, FrankenPHP with PHP-FPM / CGI / mod_php. Plesk, cPanel, Hestia, DirectAdmin work, paths only partly covered. |

| **Limited** | Alpine (version check only, no distro-backport check). A Docker/Kubernetes *host* cannot see inside images: run the script in each container or check image tags. Non-standard web root or log paths: use `--webroot`, `--access-log`, `--error-log`. |

| **Not for** | Windows (IIS, XAMPP, WAMP), macOS, *BSD, shared hosting without shell access, managed PaaS (use the provider's advisory). |

The script prints this scope and what it detected on the host at the start of every run.

| 0 | Environment: OS, package manager, container, hosting panels |

| 1 | PHP versions of every binary and `mod_php` module against the fixed releases; the distro package changelog is searched for the two CVE ids (distros backport without changing the version number) |

| 2 | Interim mitigations: `session.upload_progress.enabled`, `memory_limit=-1` enforced with `php_admin_value`, `pm.max_requests`, `post_max_size`, `fatal_error_backtraces` |

| 3 | Processes and connections: workers still running a replaced binary, shells/recon tools below a web process, connections owned by a child of a web process, outbound connections |

| 4 | Files: webshell patterns, PHP hidden in images, malicious `.htaccess`/`.user.ini`, PHP where Laravel/Symfony/Drupal/WordPress never keep PHP, `git status` against the committed code, dropped tools in `/tmp`, `/var/tmp`, `/dev/shm` |

| 5 | Persistence: web-account cron/keys/shell, `ld.so.preload`, extra UID 0, shell history of all accounts, SSH logins since the cutoff, changed system files |

| 6 | Access logs (combined, ISO-8601, JSON; `.gz`): PoC markers, `upload_progress`, POST 5xx, empty User-Agent, POST bursts, top POST targets; log paths are also read from the nginx/Apache configs |