Exploit for Improperly Controlled Sequential Memory Allocation in Php

**A free Chrome extension for Blue Teams: see a site's PHP version and whether it is exposed to PHP2Shell

(CVE-2026-109618 / CVE-2026-109619), straight from the browser.**


PHP2Shell is a pair of critical (CVSS 9.2) unauthenticated RCE bugs in PHP core, fixed on 21 Oct 2026 in

8.5.12, 8.4.27, 8.3.36 and 8.2.35. Generic tech-detection extensions show *a* PHP version but not what it means:

- Ubuntu, Debian, RHEL, Remi, cPanel, CloudLinux and Aikido ship the fix **without changing the version number**,

so `PHP/8.1.2-1ubuntu2.28` is fixed while `PHP/8.1.2-1ubuntu2.14` is not.

- Release candidates such as `8.4.27RC1` look patched but are not.

- Many sites hide the version, and only cookies, paths or the server stack give PHP away.

This extension turns those details into a verdict, the evidence behind it, and what to do .

1. Download this repository (**Code → Download ZIP**) and unzip it, or `git clone` it.

2. Open `chrome://extensions` and turn on **Developer mode**.

3. Click **Load unpacked** and select the folder.

4. Pin the icon. Reload tabs that were already open.

Works in Chrome, Edge, Brave and other Chromium browsers (Manifest V3). The interface is available in English and

Portuguese: it follows the browser language and can be switched with the **PT/EN** button in the popup.

- **Just browse.** The icon badge shows the PHP branch (e.g. `8.3`) in the verdict colour:

red = vulnerable/EOL, orange = confirm backport, green = patched/backport, grey = PHP without a version,

- **Click the icon** for the verdict, server setup (SAPI), evidence, recommended actions, other PHP hosts

loaded by the page (APIs, CDNs) and one-click lookups on Shodan, Censys and public PHP2Shell checkers.

- **Re-check** sends two plain GETs (`/` and `/index.php`) without cookies, for pages served from cache or

opened before the extension was installed.

- **Deep check** (asks for a second click) sends 15 GETs to well-known public paths. No exploit traffic,

but it can show up in a WAF: **use it only on assets you are authorized to test**.

- **Copy report** produces ticket-ready text. **History** keeps every PHP host seen and exports CSV for inventory.

A[Page loads] --> B[webRequest: response headersX-Powered-By, Server, Set-Cookie]

A --> C[Content script: DOMphpinfo, generator, .php links, errors, listings]

E[Re-check / Deep checkopt-in GETs] --> D

D --> F[lib/php-rules.jsversion + distro + vendor rules]

F --> G[Verdict, SAPI, evidence, actions]

Nothing extra is sent to the site. The extension reads what the browser already received:

| `X-Powered-By`, `Server` | Version strings: `PHP/8.1.2-1ubuntu2.14`, `Apache/2.4 (Ubuntu) PHP/8.0.30` |

| `X-Powered-By` without a version | `php`, `ThinkPHP`, `FrankenPHP`, PHP frameworks (`Fat-Free Framework`, `Nette`, `Craft CMS`…) |

| `Set-Cookie` (including HttpOnly) | `PHPSESSID`, `laravel_session`, `XSRF-TOKEN` + `_session` (Laravel), `ci_session`, Drupal `SESS…`, Nextcloud/ownCloud, `zbx_session`, Cacti, `WHMCS…` and others |

| Other headers | `X-PHP-PID`, `X-PHP-Response-Code`, `X-Pingback`, `X-Generator`, `X-Drupal-Cache`, `X-Magento-*`, WordPress `Link` |

| Page content | A public `phpinfo()` page, Apache's `` signature (`Apache/2.4 … PHP/7.2.18 Server at …`), `` for PHP CMSs and WordPress plugins, `wp-content`, `.php` links, PHP error messages |

| Exposed dev dashboards | WampServer, Laragon, XAMPP, MAMP homepages: flagged as a finding, and their PHP version is used when headers give none |

| Security findings | PHP DebugBar enabled in production (`phpdebugbar-id`), public `phpinfo()`, PHP-FPM status page |

| Every host the page loads | APIs and asset hosts are rated separately ("other hosts") |

| Attack signal | `PHPSESSID` with an abnormally large value, a PHP2Shell exploitation sign |

### 2. Version rules (`lib/php-rules.js`)

| **VULNERABLE** | 8.5 .php` | How the server answers a missing PHP file reveals nginx + FPM or FastCGI/CGI |

| `/?=PHPE9568F34-D428-11d2-A769-00AA001ACF42` | The PHP logo easter egg only answers on PHP older than 5.5 |

It stops at the first hit in each group, never sends cookies and never sends a request body.

From Hunt.io's research on attacker open directories, the badge shows `IOC` and a red banner when:

- the host is a listed scanner, payload, botnet or staging IP, the `45.198.224.0/24` scanner network, or a C2 domain;

- the page is a directory listing that contains PHP2Shell toolkit files (`aslr_exploit.py`, `deep_probe.py`,

`c2.py`, `probe_rfc1867.py`, `verify_fixation.py`, `autologin_fd.php`, `tebaran_*`).


- The version is only what the server **claims**. It can be hidden, belong to another node behind a load

balancer, or be patched by a vendor without changing the number. **Only the version and package installed on

the server are conclusive** (`php -v`, `php-fpm -v`, `dpkg -l 'php*'`, `rpm -qa 'php*'`, package changelogs).

- A patched version does not prove the workers were restarted.

- "PHP not detected" does not rule out PHP behind a CDN or reverse proxy.

- This is not an exploit or vulnerability scanner and does not replace server-side checks or tools such as Nuclei.

- Rules and indicators: `lib/php-rules.js` (`FIXED`, `DISTRO_FIXED`, `SURY_FIXED`, `VENDOR_BACKPORTS`, `IOC_*`).

- Translations: `lib/i18n.js` (every message exists in English and Portuguese).

- Tests: `node --test tests/*.test.mjs` (Node 20+).

- QA with real data: `node tools/shodan-qa.mjs ` runs every HTTP banner of a Shodan export

through the same rules and reports verdicts, parser gaps, unmapped distro packages, agreement with Shodan's own

PHP CPE, phpinfo() pages, exposed dev dashboards and IOC hits. Banners Shodan tags as honeypots are skipped by

default (`--include-honeypots` to keep them): they imitate dozens of products at once and skew the numbers.

On a 10,000-banner sample (8,983 after removing honeypots) it read a PHP version on 98.4% of hosts and agreed

with Shodan's own PHP CPE on 8,584 of 8,588. Keep exports and evidence out of git (`samples/` and `evidences/`

- After changing rules, bump `RULES_VERSION` and reload the extension in `chrome://extensions`.

Pull requests with new advisories, distro packages or detection signals are welcome. Please cite the source.

- NoceraInfoSec®, *PHP2Shell: análise de exposição e guia técnico* ("exposure analysis and technical guide", v1.0, 22 Oct 2026). Executive summary:

[docs/PHP2Shell_NoceraInfoSec_Executivo.pdf](docs/PHP2Shell_NoceraInfoSec_Executivo.pdf)

- [Hunt.io: Hunting Leaked PHP2Shell RCE Across Open Directories](

- [Brandefense: PHP2Shell fixed PHP versions](

- [ComputingForGeeks: PHP2Shell check and patch](

- [Aikido: PHP2Shell patches and free images](

- [watchTowr: PHP2Shell FAQ](

- [SOCRadar: PHP2Shell affected versions](

- [Prophet Security: detecting and investigating PHP2Shell](

- [PHP Watch: PHP easter eggs](

**Guilherme Nocera / NoceraInfoSec®**, Purple Team and Offensive Security Researcher

- Website: [nocerainfosec.com.br](

- GitHub: [github.com/nocerainfosec](

MIT