Back Sploitus

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Sploitus • October 22, 2026

A multi-server toolkit for inspecting, conducting forensic analysis, and applying security fixes for **CVE-2026-109618 / CVE-2026-109619** (PHP2Shell).

[Chinese](#Chinese) · [English](#English) · [Incident Report](docs/incident-report.zh-CN.md) · [Incident Report](docs/incident-report.en.md)

Current Release: **1.0.1** (October 22, 2026)

- [Windows PC Scanner](

- [Windows Web Scanner](

- [Complete Source Code/Documentation Package](

- [Linux + Windows Server Fix Scripts](

- [SHA256 Checksum](

PHP released an emergency security update on October 21, 2026, at 14:00 UTC (22:00 Beijing Time). Both vulnerabilities are located in the PHP runtime and could lead to unauthenticated remote code execution; upgrading the application, plugins, or the CMS itself is not a substitute for upgrading PHP.

| PHP Branch | Affected Versions | Official Fix |

| 8.5 | ` **The fix is considered complete only after the patch has been installed and all old PHP processes have been fully restarted. ** Simply running `docker restart` will not migrate old containers to the new image; similarly, updating packages alone will not replace running old PHP-FPM/Apache workers.

A full-process check/repair script is also available for direct upload and execution on the server:

- [Linux Full-Process Script](server/php2shell-fullfix-linux.sh)

- [Windows Server/NT Local Full-Process Script](server/php2shell-fullfix-windows.ps1)

- [Server Script Documentation](server/README.md)

For complete background, timeline, source, attack conditions, and production remediation procedures, see:

- [Chinese Incident Report and Remediation Guide](docs/incident-report.zh-CN.md)

- [English Incident Report and Remediation Guide](docs/incident-report.en.md)

- [Security Model and Boundaries](SECURITY.md)

- Do not automatically upgrade, modify configurations, or delete remote files.

- The SSH endpoint runs only a fixed, read-only inventory script.

- Do not receive or store server passwords; use OpenSSH private keys or `ssh-agent`.

- Use `StrictHostKeyChecking=accept-new` for the first connection; connections will be rejected if the host fingerprint changes.

- By default, the web version only listens on `127.0.0.1`. An access token must be set when binding to a non-local address.

- PHP, FPM, and CGI in the PATH, `/www/server/php`, `/usr/local`, and `/opt` directories on Linux hosts.

- SAPIs such as CLI, FPM, CGI, and Apache mod_php.

- Configurations such as `memory_limit`, `post_max_size`, and `session.upload_progress.enabled`.

- System-wide, PHP-FPM service, running process, and pool-level override configurations.

- `X-Powered-By`, `Server`, `PHP/8.x.x`, and `PHPSESSID` fingerprints exposed by HTTP targets.

HTTP fingerprinting is not an authoritative asset inventory. If the target hides its PHP version, you must use SSH mode or a host agent for scanning.

- Remote bulk inventory is designed for Linux + OpenSSH; for Windows Server/NT, please place `server/php2shell-fullfix-windows.ps1` on the corresponding server and execute it locally. The PC/Web scanning client still primarily relies on HTTP fingerprints for Windows targets.

- The scanner does not have an automatic remediation feature; remediation steps are generated for auditing and execution purposes.

- HTTP mode cannot prove that PHP is absent; when response headers are hidden, the result is explicitly marked as “Unconfirmed.”

- A single Web task can include up to 1,000 targets, and a maximum of 3 tasks can run simultaneously.

| PHP Branch | Affected | Fixed Version |

PHP 8.1 and earlier versions will be marked as high risk/EOL. PHP 8.6 RC or unknown branches will require manual review.

hk-prod,203.0.113.10,56222,root,C:\Users\me\.ssh\id_ed25519

Abbreviated entries per line are also supported:

If the private key field is left blank, `ssh-agent` or the OpenSSH default key will be used. For keys with a passphrase, it is recommended to add them to `ssh-agent` first.

The current executable file has not been digitally signed for commercial use; Windows SmartScreen may display a “Unknown Publisher” warning.

The PC version supports importing CSV files, batch concurrent scanning, viewing evidence, and exporting to HTML, CSV, or JSON.

Opens ` by default. To run the packaged version:

The current executable file is not digitally signed for commercial use, so Windows SmartScreen may display a “Unknown publisher” warning.

If you need to access the Web Version from another computer:

python web_app.py --host 0.0.0.0 --port 8765 --token "Replace with a long random string"

The SSH private key path in the web version refers to the local path on the machine running the scan backend, not the path on the computer running the browser. In a production environment, do not upload private keys to a shared web service.

python cli_app.py --servers-file samples\servers.csv --targets-file samples\targets.txt --format html --output reports\scan.html

## How to Generate Remediation Recommendations

- Source code installation path: Provides the official source code version, backup instructions, compilation steps, FPM configuration testing, and complete restart procedures.

- Distribution packages: Requires verification based on the `Fixed` status on the CVE tracking page or via USN/DSA/RHSA.

- Docker: Requires updating the image and rebuilding the container; simply running `docker restart` is explicitly prohibited.

- EOL branches: Requires upgrading to a supported stable branch or obtaining a backport patch from the vendor.

The scanner only provides the path; it does not automatically perform the fix.

This repository contains a read-only inventory scanner plus guarded Linux and Windows Server remediation scripts for **CVE-2026-109618** and **CVE-2026-109619**, collectively named PHP2Shell.

PHP released the following fixed versions on October 21, 2026, at 14:00 UTC: **8.2.35, 8.3.36, 8.4.27, and 8.5.12**. Every earlier release in those branches is affected. PHP 8.1 and older are end-of-life upstream; use a vendor/LTS backport or upgrade to a supported branch.

The scanner deliberately does not send exploit payloads. It inventories local PHP binaries, web SAPIs, Docker runtimes, package clues, security-relevant INI settings, and passive HTTP banner information. A hidden banner is reported as “unknown,” never as “safe.”

The full Linux and Windows Server scripts run in “check-only” mode by default. Apply mode requires confirmation of a full-machine snapshot, backs up the managed PHP installation, and generates a component-specific rollback script before making changes.

Read the [English incident report](docs/incident-report.en.md) before using any remediation script in production.

Prebuilt Windows executables, source archives, server scripts, and checksums are linked under “Prebuilt Downloads” above.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP2Shell Vulnerabilities Expose Millions to Remote Code Execution On October 21, 2026, the PHP project released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These flaws allow unauthenticated attackers to execute arbitrary code on PHP servers, affecting versions from 5.4 to 8.5. The vulnerabilities stem from memory management issues during out-of-memory conditions and improper handling of request states. Attack attempts were observed shortly before the patches were released, indicating active exploitation in the wild. Organizations are urged to update PHP immediately, as configuration changes cannot fully mitigate the risks. The vulnerabilities carry a CVSS score of 9.2, highlighting their severity and potential impact on approximately 70% of the internet's web applications. 88 sources 73

Extracted Entities

Exploit for Improperly Controlled Sequential Memory Allocation in Php

The full story

Extracted Entities

CVEs (2)

Domains (2)

IP Addresses (1)

Platforms (3)