PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical, unauthenticated RCE bugs, CVE-2026-109618 and CVE-2026-109619, known as "php2shell". Upgrading is the easy part. The hard part is knowing that every PHP on the box is fixed: distro backports that keep old version numbers, panel PHPs, FPM pools, mod_php that a reload did not restart, Docker images and Octane binaries. This kit answers that in one run, then walks you through the rest.

WHAT'S INSIDE

- php2shell-audit.sh (Linux, read-only):

- Finds PHP from apt/dnf/apk, ondrej/sury, Remi, cPanel ea-php, CloudLinux alt-php, Plesk, DirectAdmin, aaPanel, LiteSpeed lsphp and Homebrew, plus every running process.

- Classifies each build as FIXED, PATCHED (vendor backport, checked in the package changelog or against the Ubuntu/Debian fixed-version tables), VULNERABLE, EOL or CHECK-VENDOR.

- Flags mod_php, upload_progress / fatal_error_backtraces still on, per-request PHP_VALUE and php_value overrides, RLIMIT misuse, processes still running the old deleted PHP after the upgrade, shells started by PHP workers, and PHP Docker containers.

- Exit codes 0/1/2 for cron and monitoring.

- php2shell-audit.ps1 (Windows/IIS, read-only): checks PATH, XAMPP/WAMP/Laragon/Plesk folders, IIS FastCGI apps from applicationHost.config, Apache mod_php, settings and suspicious child processes.

- Upgrade runbooks, each from the vendor's own page with links:

- Ubuntu/Debian (incl. PPA and sury), RHEL/AlmaLinux (patched package table), Rocky, Remi, Amazon Linux 2023 / Beanstalk / Lightsail, Alpine, Docker

- cPanel EA4, CloudLinux ea-php/alt-php, Plesk (incl. the build-date trick for EOL builds), DirectAdmin, aaPanel, CloudPanel

- LiteSpeed, FrankenPHP/Octane, Windows/IIS

- Plus a restart table (why apache graceful is not enough).

- Interim mitigations, quoted from php.net/GHSA and labelled PARTIAL:

- drop-in php.ini, FPM pool, Apache, nginx (block, allow-list, read-only), Caddy/FrankenPHP and lighttpd files

- the AWS WAF rule (verbatim JSON) and Cloudflare notes

- a ModSecurity rule (derived and lab-tested) and an IIS rule (derived, untested)

- a list of the measures that did NOT help

- A post-patch verification checklist, detection hints (log greps, process auditing) and incident first steps

- A migration plan for PHP 8.1 and older (and 8.2, EOL 31 Dec 2026), including mod_php → PHP-FPM

- A rollback table, a sources list and short ES/PT/ID/JA quick starts

TESTED

- On Debian 13: the audit caught vulnerable 8.4.24, the fixed 8.4.27, and stale processes before the restart.

- 41 unit tests, shellcheck clean.

- The nginx, Apache, ModSecurity and FPM snippets were lab-tested with harmless requests (results in tests/LAB-RESULTS.md).

NOTES

- No exploit code, no PoC, no network scanner. The scripts read only the machine they run on. Use them only on systems you own or administer.

- Status as of 21 Oct 2026. Vendor package status changes quickly, and uncertain points are marked [UNCERTAIN].

- Interim measures are partial. Only a fixed PHP build plus a restart is a complete fix.

- An independent kit, not affiliated with the PHP project, The PHP Foundation, CISA or any vendor named. Informational, provided as-is, use at your own risk.