Low Severity
CVE-2026-109619
Published: Oct 25, 2026
php2shell (CVE-2026-109618, CVE-2026-109619) repo audit, CLI and GitHub Action, no server access. Lists the PHP versions it finds in Dockerfiles, compose, Kubernetes manifests, CI/setup-php and composer.json, in a repo or GitHub org, sorted by what needs the fix or a manual check. Recognizes Laravel Sail, WordPress and Drupal image tags.
# php2shell-repo-audit: which PHP versions do your Dockerfiles, CI and composer.json declare, and which need the php2shell fix (CVE-2026-109618, CVE-2026-109619)?
By [Ahmed Sozzer](https://amsozzer.com) ยท [github.com/Amsozzer1](https://github.com/Amsozzer1)
[](https://www.npmjs.com/package/php2shell-repo-audit) [](https://github.com/Amsozzer1/php2shell-repo-audit/actions/workflows/ci.yml) [](https://github.com/Amsozzer1/php2shell-repo-audit/blob/main/LICENSE)
php2shell-repo-audit is a CLI and GitHub Action that lists the PHP versions it finds declared in your repos (Dockerfiles, compose, Kubernetes, CI, composer.json) and sorts them by what needs the php2shell fix for CVE-2026-109618 and CVE-2026-109619.
<!-- intro:start -->
php2shell is two critical bugs in PHP itself; php.net published the fixed versions on 2026-10-21 in its [advisory](https://www.php.net/archive/2026.php#2026-10-21-5). The first question is which of your repos and images run a PHP that needs the fix. `grep "FROM php:"` finds some Dockerfile lines. It misses CI versions, distro packages, version files and images that bundle PHP, and it doesn't tell you which lines matter: a floating tag like `php:8.3-fpm` is only fixed after you rebuild, a Debian package can be patched without its version changing, and a composer constraint isn't a runtime at all. This tool reads those files in one repo or a GitHub org. It does not check running servers.
<!-- intro:end -->
## Check in 60 seconds, without this tool
```sh
# on a server or container
php -r 'echo PHP_VERSION, PHP_EOL;'
dpkg -l 'php*' 2>/dev/null | grep ^ii # Debian/Ubuntu packages (vendors backport fixes without changing the version)
apk info -v 2>/dev/null | grep ^php # Alpine packages
# for a built image
dock