Critical Severity
CVE-2026-109618
Published: Oct 31, 2026
Defensive checker for the PHP2Shell RCE (CVE-2026-109618/109619): is the patch actually running, log scan back to Oct 17, WAF/Sigma/Suricata rules. Stdlib Python, no remote probing.
# php2shell-check
[](https://github.com/SirjanSingh/php2shell-check/actions/workflows/ci.yml)
[](LICENSE)
Fast, zero-dependency checker and remediation helper for the **PHP2Shell** remote
code execution flaws, **CVE-2026-109618** and **CVE-2026-109619**.
What it does that the PoC-style scanners don't: it tells you whether the upgrade
is actually *running* (patched on disk but workers still on old code), scans your
logs back to **2026-10-17**, when Amazon logged the first known attempt (four
days before the patches), generates
ready-to-paste ModSecurity, Sigma and Suricata rules, checks a fleet over SSH,
and covers the follow-up session-handler issue **CVE-2026-115560**, which the
October 21 patches do not fix.
> **What this is:** a *defensive* tool. It inspects systems you operate, the
> local PHP install, version strings, Dockerfiles/compose files, your own
> running containers, your own logs, and (optionally) hosts you already have SSH
> keys for, tells you whether you're affected, and gives you the exact steps to
> fix it. It sends **no** exploit traffic and has no URL/probe mode. It is not an
> exploit and does not contain one.
## Respond in 60 seconds
```bash
curl -sO https://raw.githubusercontent.com/SirjanSingh/php2shell-check/main/php2shell_check.py
python3 php2shell_check.py check # Am I affected?
python3 php2shell_check.py harden # If so, exact fix for my OS
# Then update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and re-check.
```
## The vulnerability
On **2026-10-21** the PHP project shipped emergency patches for two critical
core RCE vulnerabilities, collectively nicknamed *PHP2Shell*:
| | |
|---|---|
| CVEs | CVE-2026-109618, CVE-2026-10961