New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619

October 23, 2026 2 min read

Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21.

PHP2Shell lets an attacker reach pre-auth RCE against PHP applications running on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento. If you run PHP behind a web server, you need to know which of your hosts are still vulnerable, and Searchlight’s researchers argue that most scanners already circulating cannot tell you reliably.

“When assessing other scanners released in the wild, we noted that most rely on version checks, or do not accurately depict vulnerable conditions for both mod_php and php-fpm,” the researchers said. A version check reads what the server advertises. It does not confirm the fault is reachable, and it splits on how PHP is run, because the two server setups fail differently.

PHP2Shell forces PHP to run out of memory at a precisely chosen moment, which leaves the interpreter holding references to memory it has already freed, and that stale state becomes a path to code execution. Detecting it means producing that memory-exhaustion condition on purpose and watching how the host reacts.

The scanner works through three checks in order. It first tries to produce a PHP memory-exhaustion error. Failing that, it watches for a differential empty HTTP 500, which signals a PHP-FPM worker that died mid-request. Only as a last resort does it fall back to reading the advertised PHP version. The probes themselves are specific: a minimal multipart control request, then up to three crafted multipart probes using PHP array keys nested 62 levels deep, growing from 1 MiB to 20 MiB. Probing stops the moment the verdict is settled.

“Given that this vulnerability requires triggering an OOM condition, it is fundamentally risky in nature, but there is no reliable way to detect this without triggering this condition,” the researchers said. They chose to trigger it anyway, because the alternative is the version-banner guesswork it built the tool to replace. In most PHP installations a worker crash recovers quickly and causes no outage, but the team tells users to take care when they run it.

If you want to know what you are firing at a host: each tested path can receive a 42-byte control request and three probes totaling about 29 MiB, and the scanner tests /index.php by default. phpMyAdmin targets get retested automatically at a second path. There is a --sapi flag that restricts detection to mod_php or PHP-FPM when you already know which one a host runs, though the default applies both sets of rules.

php2shell-scanner is available for free on GitHub.