New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 - Help Net Security
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619 , the pair of PHP remote code execution bugs patched on October 21.
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619 , the pair of PHP remote code execution bugs patched on October 21.
PHP2Shell lets an attacker reach pre-auth RCE against PHP applications running on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento.
If you run PHP behind a web server, you need to know which of your hosts are still vulnerable, and Searchlight’s researchers argue that most scanners already circulating cannot tell you reliably.
It does not confirm the fault is reachable, and it splits on how PHP is run, because the two server setups fail differently.
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in.
Only as a last resort does it fall back to reading the advertised PHP version, and they chose to trigger it anyway, because the alternative is the version-banner guesswork it built the tool to replace.
If you want to know what you are firing at a host: each tested path can receive a 42-byte control request and three probes totaling about 29 MiB, and the scanner tests /index.php by default.
Palo Alto says the risk is highest when a PAN-OS management interface accepts connections from the internet.
PHP2Shell forces PHP to run out of memory at a precisely chosen moment, which leaves the interpreter holding references to memory it has already freed, and that stale state becomes a path to code execution.
There is a --sapi flag that restricts detection to mod_php or PHP-FPM when you already know which one a host runs, though the default applies both sets of rules.
Must read: What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Fortinet and Cisco published their own advisories, and neither company has confirmed a vulnerable product so far: Fortinet is checking 12 products, Cisco 31 products and cloud services.
Customers running the products Fortinet and Cisco are still investigating do not yet know whether they are exposed, and Cisco says no workarounds exist in the meantime.
These 12 products are still under investigation: FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard and FortiEndpoint.
What happened
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619 , the pair of PHP remote code execution bugs patched on October 21.
PHP2Shell lets an attacker reach pre-auth RCE against PHP applications running on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento.
If you run PHP behind a web server, you need to know which of your hosts are still vulnerable, and Searchlight’s researchers argue that most scanners already circulating cannot tell you reliably.
What changed
It does not confirm the fault is reachable, and it splits on how PHP is run, because the two server setups fail differently.
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in.
Who is affected
Only as a last resort does it fall back to reading the advertised PHP version, and they chose to trigger it anyway, because the alternative is the version-banner guesswork it built the tool to replace.
Why it matters
If you want to know what you are firing at a host: each tested path can receive a 42-byte control request and three probes totaling about 29 MiB, and the scanner tests /index.php by default.
Palo Alto says the risk is highest when a PAN-OS management interface accepts connections from the internet.
Technical details
PHP2Shell forces PHP to run out of memory at a precisely chosen moment, which leaves the interpreter holding references to memory it has already freed, and that stale state becomes a path to code execution.
There is a --sapi flag that restricts detection to mod_php or PHP-FPM when you already know which one a host runs, though the default applies both sets of rules.
Must read: What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Response
Fortinet and Cisco published their own advisories, and neither company has confirmed a vulnerable product so far: Fortinet is checking 12 products, Cisco 31 products and cloud services.
Customers running the products Fortinet and Cisco are still investigating do not yet know whether they are exposed, and Cisco says no workarounds exist in the meantime.
What security teams should do
These 12 products are still under investigation: FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard and FortiEndpoint.
The PSIRT advisory gives no fixed versions or workarounds for the products under review, and its virtual patch field reads FortiGuard Labs covers mitigation in a separate report aimed at PHP servers in general.
What remains unknown
Fortinet’s PSIRT advisory rates CVE-2026-109618 critical with a CVSS v3 score of 9.8 and lists it as not known to be exploited.
According to the Amazon researchers, this suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information before disclosure.
However, it was unclear whether the attempts would have succeeded against real-world systems.
Attribution
Help Net Security: Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619 , the pair of PHP remote code execution bugs patched on October 21.
Help Net Security: Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in.
Infosecurity Magazine: The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as ‘ PHP2Shell ,’ could allow unauthenticated remote code execution (RCE) and server takeover on any websites relying on any PHP version released in the last decade – going back to version 5.4.
SentinelOne: One-Click Integrations for Unified Prevention, Detection, and Response On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 , both rated CVSS v4.0 9.2.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.