Low Severity
CVE-2026-109618
Published: Oct 25, 2026
Scan local PHP, Docker images, running containers, URLs and inventories for PHP2Shell exposure (CVE-2026-109618 / CVE-2026-109619). Zero-dependency Node CLI with terminal UI, HTML dashboard and GitHub Action. Read-only, no exploit code.
<div align="center">
# php2shell-check
**Find every PHP exposed to PHP2Shell on your machines, images, containers and fleet, in one command.**
[](https://www.npmjs.com/package/php2shell-check)
[](#what-is-php2shell)
[](#what-is-php2shell)
[](https://github.com/adityaaravind/php2shell-check/actions/workflows/test.yml)
</div>
> [!IMPORTANT]
> **Defensive tool.** No exploit code, no attack traffic. It reads PHP version and ini settings from targets you point it at. URL checks send one ordinary `HEAD` request and read a response header.
## Quick start
```bash
npx php2shell-check # the PHP on this machine
npx php2shell-check --containers # every running container
npx php2shell-check --docker my-app:latest --html out.html # an image, plus a dashboard
```
Exits `0` when every target is patched and `1` when something needs action, so it drops straight into CI.
## Features
- **Terminal UI**: colour status pills, findings with the exact fix per target, interim-mitigation checklist, summary bar
- **Scans everything PHP lives in**
- local binaries, auto-discovered: `php`, `php8.x`, `php-fpm*`, `php-cgi*` on `PATH` and sbin dirs
- Docker images, before you ship them
- running containers, probing both the CLI and PHP-FPM inside each one (their ini can differ)
- URLs, via a passive `X-Powered-By` fingerprint
- inventory files (CSV, TSV, JSON