Critical Severity
CVE-2026-109618
Published: Oct 25, 2026
The safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619). Local, offline, vendor-backport aware.
# php2shell-doctor
[](LICENSE)
[](https://scorecard.dev/viewer/?uri=github.com/andreysheva/php2shell-doctor)
<p align="center">
<img src="docs/terminal.png" alt="php2shell-doctor scan output in a terminal" width="720">
</p>
php2shell-doctor is the safe checker for the **php2shell** PHP vulnerabilities ([CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w), [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)).
It tells you whether your PHP is patched, running old code, misconfigured, or already exploited.
No exploit probes, no network access.
It works both for enterprises with hundreds of servers and for one WordPress instance in the closet.
Single static binary, zero dependencies.
## What this does
- **Classifies every PHP runtime on the host** — PATH, distro packages (dpkg/rpm/apk), cPanel, Plesk, LiteSpeed, Homebrew/scoop, Docker containers and images.
- **Vendor-backport aware** — ships a versioned database of distro fixes (Ubuntu revisions, Debian DSA/DLA, RHEL errata policy, Alpine, remi, sury, official images) with real dpkg/rpm comparison. Unverifiable cases report `VERIFY_VENDOR`, never a silent "safe".
- **Finds the patch gap that isn't a version** — detects workers still running pre-upgrade code (`PATCHED_STALE_WORKERS`) across Linux, macOS and Windows.
- **Audits the config surface** — `session.upload_progress` (CVE-2026-109619 + the unpatched CVE-2026-115560), `memory_limit` OOM trigger, per-directory `.user.ini`/`.htaccess` and FPM pool overrides.
- **Looks up appliances** — is your ClearPass/ONTAP/SEPM affected? (`product -q`, from the NCSC-NL 751-product inventory.)
- **Hunts for exploitation** — scans logs for the documented attack signatures; ingests [assetnote/php2shell-scanner](https://github.com/asse