PHP2Shell scanner

A free, local checker for CVE-2026-109618 and CVE-2026-109619 on Linux servers you administer. Tool version 1.0.0 · CVE data 2026-10-22.

What is PHP2Shell?

PHP2Shell is the name for two critical bugs in PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), disclosed on 21 October 2026. They are use-after-free bugs that can lead to unauthenticated remote code execution. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Read more: PHP Foundation advisory · CERT-EU 2026-018

What the script does

• Scans, read-only, by default. A plain run changes nothing and does not use the network. It finds CLI php, PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed lsphp, and reads only the local package changelog to see if a backported fix is present.
• Upgrades only if you ask (--fix). It uses apt, dnf, yum or apk, and only takes a same-branch package at or above the fixed release (or one whose changelog names both CVEs). It does not compile PHP, add repositories, or move PHP 8.1 and older to a new major version. An upgrade still waits for a separate yes.
• Temporary workarounds, also opt-in (--workarounds). These do not upgrade PHP; the vulnerable build stays installed. Config is backed up to /var/backups/stacutis/<stamp>/ and --rollback <stamp> restores it. Each tradeoff is printed before you confirm.
• Optional read-only extras: --ioc looks for published indicators (not proof of a break-in) and --containers lists local Docker containers that look like PHP. It does not patch containers.

Needs bash 4.3 or newer. A scan works without root; --fix, --workarounds and --rollback need root. Exit code 0 means no PHP or everything is patched, 1 means something is vulnerable or only mitigated. Exit 0 does not mean the host was checked for a past break-in. The full flag list is in the README.

What it changes

Nothing, unless you pass --fix or --workarounds and answer y. Add --dry-run to see the plan without writing anything. The script never sends data anywhere.

• --fix: upgrades the installed PHP packages with your package manager (same branch only), then restarts PHP-FPM / Apache so workers pick up the new code.
• --workarounds: writes 99-stacutis-php2shell.ini in PHP's conf.d, adds a marked block to vulnerable FPM pool files, and on mod_php hosts writes stacutis-php2shell.conf in the Apache config dir. Then restarts those services.
• Undo: workaround files are backed up to /var/backups/stacutis/<stamp>/ first. Run sudo bash stacutis-php2shell.sh --rollback <stamp> to put them back. Package upgrades are not rolled back.
• --log: appends a line to /var/log/stacutis-php2shell.log. Off by default.

Download

SHA-256 (from CHECKSUMS.txt):

Verify before running

Download, check, read, then run. Please don't pipe the download straight into a shell.

cd /tmp
curl -fsSL -o stacutis-php2shell.sh https://www.stacutis.com/php2shell.sh
curl -fsSL -O https://www.stacutis.com/CHECKSUMS.txt
sha256sum -c CHECKSUMS.txt      # must print: stacutis-php2shell.sh: OK
less stacutis-php2shell.sh      # read it first
sudo bash stacutis-php2shell.sh # scan only; changes nothing

If a menu appears, option 4 leaves the server as it is. The checksum catches a broken download, not a replaced repository, since both files live together.

Disclaimer

Provided as-is, without warranty. Run it only on servers you own or administer. Take a backup before you answer yes to any change. Released under the MIT License.