Home / Scanners / PHP RCE Scanner
2026 Core Threat: PHP2Shell (CVE-2026-109618)

PHP RCE & PHP2Shell Vulnerability Scanner

Continuously audit your public web applications and APIs for PHP core memory corruption, PHP2Shell (CVE-2026-109618), PHP-CGI argument injection, and exposed diagnostic files before attackers breach your perimeter.

  • PHP2Shell Memory Corruption Detection: Identifies unpatched PHP 8.2, 8.3, 8.4, and 8.5 runtimes vulnerable to request shutdown RCE.
  • PHP-CGI Argument Injection (CVE-2024-4577): Non-destructive checks for Best-Fit character mapping bypasses.
  • Diagnostic Endpoint Discovery: Automatically flags exposed phpinfo.php, info.php, and backup scripts.
  • Actionable Remediation: Exact upgrade paths and hardening configurations (e.g. expose_php = Off).
Scan Your Domain for PHP RCE Technical Details ↓
bspeka-scanner // php_rce_audit
Critical Severity (CVSS 9.8) app.target-host.com
PHP2Shell Core Memory Corruption (CVE-2026-109618)
Detected runtime: PHP/8.4.26. Vulnerable to fatal abort longjmp() cleanup bypass in request shutdown routines, enabling unauthenticated remote code execution.
Remediation: Upgrade PHP runtime to version 8.4.27 or higher immediately.
High Severity app.target-host.com/phpinfo.php
Publicly Exposed phpinfo() Diagnostic Endpoint
Discloses full environment variables, database credentials, server paths, and active modules.

Understanding the PHP2Shell Threat Vector

How memory-safety abort sequences in core PHP leave servers exposed to unauthenticated RCE.

The Fatal Abort longjmp() Bypass

When PHP encounters an unrecoverable condition (such as exceeding memory_limit during large file uploads), it uses longjmp() to abort execution. This skips normal destructors and leaves uninitialized pointers in global memory.

Request Shutdown Hijacking

During the final request shutdown phase, cleanup routines inadvertently process these corrupt pointers as valid structures. Threat actors craft multipart payloads that take control of instruction pointers.

Safe, Non-Destructive Scanning

bspeka verifies version bounds, header disclosures, and CGI configurations without sending malicious payloads or causing denial of service on your production workloads.

Vulnerable PHP Branch Matrix

Official patch levels required to protect against PHP2Shell and critical RCE vectors.

PHP Branch Vulnerable Versions Secured Patch Release Status
PHP 8.5 8.5.0 through 8.5.11 PHP 8.5.12+ CRITICAL (CVSS 9.8)
PHP 8.4 8.4.0 through 8.4.26 PHP 8.4.27+ CRITICAL (CVSS 9.8)
PHP 8.3 8.3.0 through 8.3.35 PHP 8.3.36+ CRITICAL (CVSS 9.8)
PHP 8.2 8.2.0 through 8.2.34 PHP 8.2.35+ CRITICAL (CVSS 9.8)
PHP 7.x, 8.0, 8.1 All versions (End-of-Life) Upgrade to 8.3+ UNSUPPORTED / EOL

Frequently Asked Questions

Clear answers on how to detect and remediate PHP Remote Code Execution flaws.

What is PHP2Shell (CVE-2026-109618)?
PHP2Shell is a pair of critical vulnerabilities in core PHP where memory exhaustion or fatal aborts bypass memory cleanup routines, corrupting request shutdown handlers and allowing unauthenticated remote code execution.
Why does hiding X-Powered-By matter?
Exposing X-Powered-By: PHP/8.4.26 allows automated vulnerability scanners and threat actors to filter internet assets for exact vulnerable versions. Disabling expose_php = Off stops opportunistic automated targeting.
How quickly will bspeka detect an unpatched PHP server?
Under continuous monitoring plans, bspeka scans your assets every 24 hours (or within 5-15 minutes of new DNS record discovery), immediately alerting your team via Slack or Email if a vulnerable version is detected.

Audit Your Perimeter for PHP RCE Flaws

Scan your domains, APIs, and microservices for PHP2Shell, CGI flaws, and exposed configurations today.

Launch Free PHP Scan