Critical Severity
CVE-2026-109619
Published: Oct 25, 2026
Check if your server is vulnerable to PHP2Shell (CVE-2026-109618 & CVE-2026-109619). Free, open-source scanner with GUI + CLI, no dependencies.
# PHP2Shell Scanner
A single-file scanner that fingerprints websites and checks whether their PHP is affected by **PHP2Shell**. PHP2Shell is a pair of critical unauthenticated RCE bugs in PHP, CVE-2026-109618 and CVE-2026-109619.
You give it a list of URLs or subdomains. For each one it works out what the site runs (web server, PHP, CMS, frameworks, CDN or WAF, and so on) and whether the PHP version is affected.
> ⚠️ **Only scan targets you are authorized to test**, for example assets that are in scope for your bug bounty program. Check the program's rules on automated scanning and rate limits before you start.
<details>
<summary><b>More screenshots</b> — the empty state, the form filled in, and a row expanded</summary>
<br>
All four are real captures against the local test lab in [`lab/`](lab/) — genuine PHP 8.5.11 (unpatched) and 8.5.12 (fixed) containers, not staged data.
| | |
|---|---|
|  |  |
| Empty state on first load | Form filled in, ready to scan |
A row expanded — this is the case where the version is completely hidden and the [active patch oracle](#evidence-for-bug-reports-and-attack-surface-context) settles it anyway: `127.0.0.1:18103` discloses no PHP version, but the behavioral check actively confirms `VULNERABLE` with high confidence.
</details>
---
## What it checks
| | |
|---|---|
| **Vulnerability** | CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2),