Low Severity
CVE-2026-109618
Published: Oct 29, 2026
Exposure scanner, patch verifier and threat hunter for CVE-2026-109618/9, with a cyberpunk TUI.
# php2shell-audit
**Exposure scanner, patch verifier and threat hunter for the October 2026 PHP
`php2shell` vulnerabilities (CVE-2026-109618 / CVE-2026-109619).**
`p2s` answers two questions in one zero-dependency Go binary:
1. **Am I exposed?** It inventories PHP binaries, running workers, distro
packages, containers and remote endpoints, verifies the patch level against
the published fixed releases, and evaluates the runtime configuration that
makes the bugs reachable.
2. **Was I exploited?** It parses web/PHP/system logs, scores web roots for
webshells, inspects session files, checks the live process tree for shells
and egress, and looks for cron/systemd/SSH-key persistence. Evidence can be
exported with a SHA-256 manifest.
An optional, authorization-gated `offense` mode validates the two primitives
with bounded probes. It does not weaponise them; see
[`p2s offense`](#p2s-offense--authorized-validation).
```
$ p2s scan --local
php2shell-audit 0.1.0 2026-10-23T04:00:48Z
mode: scan
SUMMARY: 0 critical 2 high 3 medium 0 low 1 info (6 total)
Inspected 5 PHP target(s): 3 vulnerable, 0 end-of-life, 0 patched, 2 unverified.
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor backport) and restart
every worker. Do not rely on application-level patches.
TARGETS
NAME KIND SAPI VERSION STATUS
binary:/usr/bin/php8.4 binary cli 8.4.26 vulnerable
packages: php8.4-bcmath +11 more ... package - 8.4.26 vulnerable
host:web01 host fpm 8.4.26 vulnerable
...
```
> **Scope.** `scan` and `hunt` are defensive: remote checks are passive GET
> requests (plus optional operator-supplied paths such as an authenticated
> `phpinfo` page). The optional `offense` mode adds **authorized, bounded
> validation** of the two CVEs behind a scope file and an audit trail. It still
> contains no exploit payload, no weaponised RCE chain, no revers