Low Severity
CVE-2026-109619
Published: Oct 26, 2026
Read-only verification PoC for CVE-2026-109618 / CVE-2026-109619 (php2shell). Checks PHP patch level remotely across a fleet, plus an on-host agent verifying every mitigation in the PHP advisories. No exploit code.
```
___ _ _ _
| _ \___ ___| | (_)___ PHP2Shell - Verification Script
| _/ _ \/ -_) | | / -_) CVE-2026-109618 / CVE-2026-109619
|_| \___/\___|_|_|_\___| by Poellie - github.com/Poellie01
```
# PHP2Shell — Verification Script
Defensive verification tooling for the two critical PHP vulnerabilities disclosed on
**2026-10-21**. It tells you whether a host is patched, whether the advisories'
mitigations are *actually in effect* — including the override traps the advisories warn
about — and whether your logs contain the error classes they tell you to review.
**This repository contains no exploit code.** Everything here is read-only: it inspects
versions, configuration and logs. Nothing sends an attack payload. CI fails the build if
exploit-shaped content appears.
| CVE | Title | Advisory |
|---|---|---|
| CVE-2026-109618 | RCE via OOM corruption | [GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) |
| CVE-2026-109619 | RCE via stale global state | [GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) |
Both are CVSS v4.0 **9.2**, unauthenticated RCE as the web worker account.
**Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12.** Updating is the only complete fix —
both advisories say so explicitly. Everything else reduces exposure to specific paths.
## Contents
| File | Role |
|---|---|
| `php2shell_verify.py` | Python CLI. One host or a whole fleet. Standard library only. |
| `verify_php2shell.php` | On-host agent. Checks every advisory item from inside the serving worker. |
| `scan_logs.py` | Log review for the error classes GHSA-6wmf-4rv5-p3rp says to investigate. |
| `deploy/ansible-verify.yml` | Run the agent fleet-wide with Ansible, writing nothing remotely. |
| `deploy/prepare-agent.sh` | Generate a token and a configured agent copy for HTTP deployment. |
| `docs/supplier-request.md` | Template for getting answers out of a third-party host. |
## Quick start