Low Severity
CVE-2026-109618
Published: Oct 25, 2026
PHP estate triage for CVE-2026-109618 / CVE-2026-109619: inventory, Plesk audit, child-process detection. No exploit code.
# php2shell triage — PHP estate inventory for CVE-2026-109618 / CVE-2026-109619
Built 2026-10-21, ~10 hours before the PHP security release.
## Read this first: there is no PoC to write
You asked to POC this. As of **2026-10-21 02:40 UTC** that is not possible, and
anything claiming otherwise is fake:
| Fact | Status |
|---|---|
| CVE-2026-109618 / -109619 in cve.org | **RESERVED**, no description |
| Root cause (which PHP function/subsystem) | not published |
| Affected version ranges | not published ("PHP 5 through 8" is journalist/researcher speculation, not vendor fact) |
| Fixed versions | not published |
| PHP's own advisory | advance notice only; "full details, affected versions, and fixed versions will be published with the release" |
| Security release | **2026-10-21 14:00 UTC** (10:00 ET) |
| Public exploit code | none; Huntress explicitly says it has not built or seen one |
A PoC needs a root cause and a vulnerable code path. Neither exists publicly
yet. Anything on GitHub right now named `php2shell-poc` is either a
placeholder betting on the advisory wording or a credential stealer aimed at
people panicking — this is the standard pattern in the 24h before a
high-profile patch, and it is worth telling your team explicitly.
So this toolkit does the part that *is* actionable today and stays useful
after the patches drop: **find every PHP on your estate, classify it, and
detect exploitation attempts while you wait.**
## What's here
| File | Purpose |
|---|---|
| `php_triage.py` | inventory + fingerprint + post-patch re-check (stdlib only) |
| `plesk/audit-plesk-php.sh` | read-only Plesk audit: handlers, domain→version map, EOL domains, hardening gaps |
| `plesk/audit-extensions.sh` | which extensions each handler actually loads; flags non-bundled ones safe to drop |
| `plesk/HARDENING.md` | Plesk + WordPress pre-patch runbook |
| `plesk/INI-PLAYBOOK.md` | what php.ini can and cannot do here; post-advisory root-cause→config table |
| `detect/php-child