CERT-AGID Details Tools to Check Exposure to PHP2Shell Vulnerabilities

Summary

CERT-AGID describes two tools and local checks for assessing PHP systems potentially affected by CVE-2026-109618 and CVE-2026-109619, warning that scanner results are not definitive and active tests can affect services.

Key points

CERT-AGID highlights two open-source tools to help identify PHP systems potentially vulnerable to CVE-2026-109618 and CVE-2026-109619.
OpenAI PHP2Shell Checker checks a server’s declared PHP version through HTTP headers or checks a local installation; its remote check does not attempt exploitation.
Assetnote PHP2Shell Scanner sends specially crafted multipart/form-data requests and examines server responses for anomalies, including memory errors and unexpected PHP process interruptions.
Assetnote’s active tests may cause errors or interfere with services; CERT-AGID recommends using it only on authorized systems after assessing potential impact.
Scanner results are not conclusive: a negative result does not rule out vulnerability, while a positive result may need follow-up to exclude false positives.
Administrators are advised to prioritize internet-exposed services and verify the PHP version actually used by the web service and whether security fixes, including backported fixes, are installed.
Local checks can identify PHP components and settings, but the command-line PHP version may differ from the web service version and configuration checks do not establish patch status.

Article Details

Defense Focus: Identify PHP systems potentially affected by CVE-2026-109618 and CVE-2026-109619, then confirm the PHP version actually serving web requests and whether the relevant security fixes are installed.
Detection Methods: Compare the PHP version reported in HTTP headers with known fixed versions; this check does not attempt exploitation.
Send purpose-built multipart/form-data HTTP requests and inspect server responses for anomalies such as memory errors or unexpected PHP process termination.
On systems where remote checks cannot determine the version, inspect the installed PHP version, Apache PHP modules, running PHP-FPM processes, and selected PHP-FPM settings.
Treat scanner results as indicative: negative results do not rule out vulnerability, and positive behavioral results may require investigation for false positives.
Data Sources: HTTP response headers
Responses to crafted multipart/form-data requests
Installed and service-used PHP versions
Apache module listings and running PHP-FPM process information
PHP-FPM settings, including session.upload_progress.enabled, memory_limit, and fatal_error_backtraces
Applied security updates, including backported fixes
Platforms: PHP
Apache
PHP-FPM
Defensive Actions: Prioritize internet-exposed services and verify the PHP version actually used by each web service, rather than relying only on the command-line interpreter version.
Confirm that applicable security fixes are installed, including fixes distributed through backports.
Use active Assetnote PHP2Shell Scanner tests only on authorized systems, after assessing potential impact, preferably in test environments or maintenance windows.
When remote checks cannot identify the PHP version, inspect the host locally; treat process and configuration checks as supporting evidence, not proof of patch status.
Involve the relevant technology providers in verification and investigate positive behavioral results before concluding that a system is vulnerable.