Astra Security unveils free utilities to detect critical PHP2Shell flaws
Astra Security has launched two complimentary tools—a public PHP2Shell Checker and an open-source php2shell-triage script—to help organisations identify and remediate the newly disclosed PHP2Shell vulnerabilities.
Astra Security released two free resources to address the critical PHP2Shell flaws disclosed this week, identified as CVE-2026-109618 and CVE-2026-109619, each scoring 9.2 on the CVSS v4.0 scale. The first, a public-facing PHP2Shell Checker, lets anyone input a website URL to see whether the displayed PHP version predates the fixed releases, without needing an account. The second, php2shell-triage, is an open-source, read-only script that examines the binaries behind active PHP workers, detecting outdated runtimes and potential exploitation indicators.
Astra recommends organisations locate vulnerable installations, apply the patches available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, restart PHP workers, and verify the updated runtimes are in use. For systems running end-of-life PHP versions, upgrades are necessary, and where immediate patching is impossible, isolation is advised. Founder and CEO Shikhil Sharma emphasized that the key challenge during such disclosures is determining exactly what is running in production.
Why it matters
The tools give organisations a practical way to assess exposure to a high-severity PHP exploit and act quickly to protect their web services.
In this story
