Low Severity
CVE-2026-109619
Published: Oct 25, 2026
php2shell vulnerability scanner (CVE-2026-109618 / CVE-2026-109619) — detects vulnerable PHP servers even when version is hidden. No exploitation performed.
# php2shell Scanner
**Detection only — no exploitation performed.**
A lightweight Python scanner that checks if a PHP server is affected by the php2shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619) — unauthenticated RCE in PHP's `session.upload_progress` handler.
## Vulnerabilities
| CVE | Title | CWE | CVSS 4.0 |
|---|---|---|---|
| CVE-2026-109618 | Out-of-Bounds Memory Corruption | CWE-787 | 9.2 CRITICAL |
| CVE-2026-109619 | Use-After-Free | CWE-416 | 9.2 CRITICAL |
**Affected:** PHP 5.4.0 through all unpatched versions
**Fixed in:** PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12
**No fix available:** PHP 5.4 — 8.1 (end of life)
**All SAPIs affected:** mod_php, PHP-FPM, CGI, LiteSpeed, FrankenPHP
## How It Works
The scanner uses **two detection methods**:
### 1. Version Detection
Detects PHP version from HTTP response headers (`X-Powered-By`, `Server`), `phpinfo()` page content, or the local PHP binary (`--local` mode).
### 2. Upload Progress Probe (the key feature)
Many production servers **hide the PHP version** (`expose_php = Off`). This scanner can still detect vulnerability by probing `session.upload_progress`:
- Sends a **normal** multipart POST with a `PHP_SESSION_UPLOAD_PROGRESS` field
- If the feature is enabled, PHP automatically starts a session and returns `Set-Cookie: PHPSESSID=...`
- A server with active `session.upload_progress` is **likely vulnerable** unless patched
**This is NOT exploitation.** It uses [documented PHP behavior](https://www.php.net/manual/en/session.upload-progress.php). No memory corruption, no crafted payloads, no malicious data.
## Risk Assessment
The scanner assesses risk level based on:
| Factor | Risk Impact |
|---|---|
| mod_php or LiteSpeed | CRITICAL — unauthenticated, pre-application |
| PHP-FPM / CGI | HIGH — exploitable via stale state (CVE-2026-109619) |
| upload_progress = On | Attack vector is active |
| upload_progress = Off | Partial mitigation only (other paths exist) |
| PHP 5.4 — 8.1 | No fix