PHP2Shell exposure check

Decides whether a server's PHP is affected by CVE-2026-109618 and CVE-2026-109619 from facts collected on the server itself, including distribution backports, missed restarts and interim mitigations. The verdict is computed in this tab; what you paste is not sent anywhere.

1Collect

PHP probe

php2shell-selfcheck.php

or fetch it on the server

curl -fsSLO https://php2shell.sqzer.com/downloads/php2shell-selfcheck.php

Set $TOKEN in the file to 12 or more random letters, digits, - or _, for example the output of openssl rand -hex 16.
Give the file an unguessable name and upload it to the site's web root.
Open https://<site>/<file>.php?k=<TOKEN> once. The file then tries to delete itself and says so if it cannot.
Repeat per vhost and per PHP-FPM pool; each may run a different PHP.

Server script

php2shell-server-check.sh

or fetch it on the server

curl -fsSLO https://php2shell.sqzer.com/downloads/php2shell-server-check.sh && sha256sum php2shell-server-check.sh

read it, then run it

sudo sh php2shell-server-check.sh --logs

POSIX sh, read-only, no network access. Compare the printed hash with the one shown above (also in SHA256SUMS) and read the script before you run it.
Reports installed PHP packages and the CVE entries in their changelogs, and PHP processes still mapped to files replaced by an update.
--logs scans web server, PHP-FPM and kernel logs for indicators; --webroot DIR lists PHP files changed in the last 3 days.
Run as root to inspect processes owned by other accounts.

Response header

curl -sI https://<site>/ | grep -i x-powered-by

Use only when you have no access to the server.
Works only if the header is exposed, and describes only the PHP behind that URL.
Debian and Ubuntu package revisions in the header are still recognised. Settings, other vhosts and restarts are not visible.

3Result

No result yet. Collect facts on the server, paste the output and run the check.

Possible verdicts
Patched	At or above the upstream fixed release, or a distribution package carrying both fixes.
Vulnerable	Below the fixed release, including upstream builds of end-of-life branches.
Fix pending	The distribution tracks the CVEs but has not shipped a fixed package.
Restart needed	The fixed package is installed; the running PHP is still the old build.
Undetermined	Not enough evidence. Never reported as safe.

Method

A version at or above the upstream fixed release for its branch is patched.

Debian and Ubuntu packages are compared with the distribution's fixed version using dpkg ordering.

On the RHEL family the evidence is the CVE entries in the package changelog, collected by the server script.

A running version older than the installed package, or a PHP process mapping a deleted file, means restart needed.

deb.sury.org builds, official Docker images and self-built PHP are judged against upstream releases.

Interim mitigations are reported but never change a verdict.

Missing evidence gives Undetermined, never safe.

Scope

No request is sent to your server. The probe reads versions, packages and settings. The server script also reads package changelogs, the process list with command lines, the files each PHP process has mapped and PHP and web server configuration files. With --logs and --webroot it also reads logs, session file sizes and the names and dates of PHP files. Its terminal output can show command lines and log lines; the page needs only the block between the BEGIN and END lines.

A verdict is not proof that an attack would fail. Read the upstream advisories and your distribution's notices as well.