Low Severity
CVE-2026-109618
Published: Oct 25, 2026
Check and apply the php2shell fix (CVE-2026-109618, CVE-2026-109619) on hosts, SSH servers and Docker images
# php2shell-check
Check, then apply, the **php2shell** fix on your PHP runtimes: system packages, standalone binaries, Docker containers (FrankenPHP included) and remote servers over SSH.
```bash
git clone https://github.com/MakFly/php2shell-check.git
cd php2shell-check
./check.sh # this host: packages, binaries, containers
./servers-check.sh # every SSH target listed in servers.txt
./docker-scan.sh ~/code # Dockerfiles and compose files of a folder
```
> Script output is in French. The status markers (`[OK]`, `[VULN]`, `[??]`) and exit codes are language-neutral.
## Why
**php2shell** is the name given to two remote code execution flaws in PHP core: **CVE-2026-109618** and **CVE-2026-109619** (CVSS v4.0 9.2). The fix ships in the PHP security release of **October 21, 2026, 14:00 UTC** (16:00 in Paris, CEST).
No configuration workaround is confirmed: **only upgrading PHP fixes it**. These scripts answer three questions: what is still vulnerable, how to fix it, and what to watch in the meantime.
## Features
Nothing is hardcoded for a given environment:
- **Fixed version**: read live from php.net, per branch (8.2 to 8.5). Until the release is out, the scripts answer `[??]`, never `[OK]`.
- **End-of-life branches** (7.x, 8.0, 8.1): detected through php.net's `supported_versions` list and reported `[VULN]`, since they will get no fix.
- **Distro packages**: Debian/Ubuntu and RHEL backport fixes without bumping the version number. A package is therefore judged on its changelog (CVEs cited) **or**