Critical Severity
CVE-2026-109618
Published: Oct 25, 2026
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
# php2shell-scanner
Non-destructive scanner (with opt-in probe) for **CVE-2026-109618** (RCE via
OOM corruption) and **CVE-2026-109619** (RCE via stale global state) — core
PHP bugs fixed in `8.2.35 / 8.3.36 / 8.4.27 / 8.5.12`.
> ✅ **Verified against the official php-src advisories (2026-10-21, Critical).**
> The CVE IDs and the fixed-version table below match upstream exactly.
>
> - CVE-2026-109618 — [GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
> - CVE-2026-109619 — [GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
### Affected / fixed versions
| Branch | Affected | Fixed |
|--------|----------|-------|
| 8.2 | < 8.2.35 | 8.2.35 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.5 | < 8.5.12 | 8.5.12 |
| < 8.2 | EOL — no upstream patch | check distro/OSV backport |
## Strategies
| Mode | What it does |
|-----------|--------------|
| `LOCAL` | `php -r` for exact runtime version, SAPI, `memory_limit`, `post_max_size` |
| `REMOTE` | Version fingerprint via `X-Powered-By` / `Server` headers and exposed `phpinfo()` |
| `PRESENCE`| PHP detection without version (PHPSESSID, `.php` refs, redirects) |
| `BANNER` | Robust raw-socket banner grab — HEAD/GET/OPTIONS + malformed probe, http/https, error-page disclosure |
| `RECON` | Subdomain enumeration via **crt.sh** (Certificate Transparency) with **subfinder** fallback/merge, then fan-out scan resolving hosts |
| `PROBE` | *(opt-in)* Large multipart requests to observe worker instability — **may cause DoS** |
## Install
```bash
git clone https://github.com/JoasASantos/php2shell-scanner.git
cd php2shell-scanner
# stdlib only — no pip deps.
# Optional recon fallback: ProjectDiscovery subfinder
# brew install subfinder (or: go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest)
```
## Usage
```bash
# Local runtime check
python3 php2shell_scan.py --local
# Single remote target, lo