CVE-2026-109618 · CVE-2026-109619
PHP2Shell is a pair of critical, pre-authentication remote code execution flaws in the PHP core itself, disclosed October 21, 2026 and already exploited in the wild. Any PHP endpoint can be enough. Check your exposure in under a minute.
An active but non-destructive test built on Assetnote's detection logic: a minimal control request followed by up to three crafted multipart probes. No exploit is delivered; we only read how your server responds.
Leave your work email and a Cenobe engineer will reach out about your result: remediation planning, patch guidance, compromise assessment and hardening.
The threat
Both flaws live in PHP's request-parsing core. The malicious request is processed before your application code runs. No login form, no framework and no application-level authentication can stop it. If PHP parses the request, the code path is reachable.
Exhausting PHP's memory mid-request corrupts the request state. During cleanup, PHP executes attacker-controlled data. One crafted POST is enough; the request never reaches your code.
One request can poison global state that a later request inherits, via session upload progress, fatal-error backtraces and other early-lifecycle paths. No session_start() required.
Exploitation attempts were observed in the wild days before the public advisory. Public PoCs appeared within hours. Cloudflare, Akamai, AWS and Azure all shipped emergency WAF rules, but only patching fully fixes it.
AWS reports attack traffic targeting PHP2Shell four days before public disclosure.
PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Source backports published for 7.4–8.1. Both CVEs rated CVSS 9.2.
Public PoC repos multiply; attempted webshell planting via PHP_SESSION_UPLOAD_PROGRESS observed from scanning infrastructure.
75%+ of server-side web stacks run PHP. Run the check above, then patch.
How the check works
A 42-byte multipart control request establishes your server's normal behavior, so the verdict compares probes against your baseline, not a generic guess.
Crafted multipart bodies (1 → 8 → 20 MiB) with array keys nested 62 levels deep exercise the vulnerable parser path, using the same detection logic as Assetnote's scanner.
We flag Vulnerable only on hard signals: a PHP memory-exhaustion fatal, a differential empty HTTP 500, a worker crash, or an advertised unpatched version. And every positive verdict is reproduced in a second run before we show it. WAF rejections and ambiguous 500s are reported as inconclusive, never as proof.
No exploit payload is delivered and nothing is written to your server. Probing stops the moment the verdict is settled. About 29 MiB of traffic per check.
Next steps
Every check ends with a clear verdict on screen. Leave your email and a Cenobe engineer follows up with everything your team needs to act today:
Probe-by-probe breakdown: what was sent, what your server answered, and exactly which signal settled the verdict.
Fixed versions per branch (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35), vendor backport caveats, and container-image rebuild guidance.
The exact php.ini / FPM / WAF measures that reduce exposure while you patch, with an honest note on why none of them is a fix.
What to look for in logs and process trees to determine whether someone got there before you.
FAQ
It's non-destructive but active: the probes are designed to trigger the vulnerable code path, which on an unpatched server manifests as a memory-exhaustion error in a single request. On fragile systems any active request carries some risk, and the check may be blocked, rate-limited or logged. Run it only on systems you own or are authorized to test.
Usually a WAF or reverse proxy rejected the probes before PHP parsed them, which incidentally also reduces your exposure. For a definitive answer, verify the installed PHP build on the host itself, or contact us for an authenticated assessment.
No remote check can guarantee that. Vendor backports can patch PHP without changing the advertised version, and WAFs can mask crash signals. Confirm the actual build on the host (php -v, package manager, or vendor advisory).
We may contact you about your result and related Cenobe services, only because you explicitly agreed to it. We don't scan targets without the authorization checkbox, we don't sell data, and you can opt out anytime by replying STOP.
Yes, that's what we do. Leave your email after the check and we'll reach out, or contact us directly. Cenobe handles remediation planning, compromise assessment and hardening for PHP estates of any size.