Astra Security releases a free tool to help institutions detect and fix PHP2Shell vulnerabilities

Clemont, Delaware, October 23, 2026 / PRNewswire / -- Astra Security Today, we are releasing two free resources to help organizations address the critical PHP vulnerabilities PHP2Shell disclosed this week. The first is a PHP2Shell Checker for public websites. The second is an open-source tool php2shell-triage for more in-depth investigations.

These vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, respectively. They have been rated at 9.2 in CVSS and v4.0, and may allow for unauthorized remote code execution through the PHP core runtime. Fixes have been provided for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 of PHP. Since PHP is widely used on websites, CMS platforms, custom applications, and infrastructure managed by vendors, many organizations may need to expand their investigation beyond the applications that they directly maintain.

Start with publicly exposed assets: Use PHP2Shell Checker to scan publicly available assets.

PHP2Shell Checker will compare the PHP version displayed on public websites with the fixed version. This tool can be used without an account. Astra Security indicates that the detection results should only be considered as preliminary signals, not as final conclusions: proxies, hosting service providers, and server settings may hide or alter version information, and a result of 'no issues found' does not guarantee the security of the internal system either.

Conduct a more in-depth investigation of our own systems: Use php2shell-triage to evaluate the internal systems.

php2shell-triage can help teams assess the PHP runtime on different servers API. It marks outdated working processes, identifies potential signs of exploitation, and develops plans for fixing PHP vulnerabilities. This read-only script checks the binary files behind the running PHP working processes, rather than simply relying on the version displayed in the command line. According to Astra Security, this can reveal situations where the server reports a fixed PHP version, but old working processes are still using a vulnerable runtime, thereby posing a risk of unauthorized remote code execution (RCE).

How to fix PHP2Shell: Immediate remedial measures

Astra Security indicates that affected installation instances should be identified, updates should be applied, the PHP worker process should be restarted, and it should be verified that the fixed runtime is indeed running. If there is suspicion of a system intrusion, evidence should be preserved before restarting. Versions with a lifecycle that has ended (8.1 and earlier) will not receive official fixes, therefore an upgrade plan needs to be established. If it is temporarily not possible to apply patches, then isolating systems with vulnerabilities should be considered.

"In incidents of disclosure like PHP2Shell, the most difficult question to answer is not 'Do we have vulnerabilities?', but rather 'What is actually running at the moment?'" said Shikhil Sharma, founder and CEO of Astra Security.

Free Tools

PHP2Shell Guidance

This week's related security announcements

• LiteLLM Supply Chain Attacks
• GitLab CVE -2026-110264: Critical Regular Expression Vulnerability in CVSS 10.0 RCE
• Node.js October 2026 Security Patch
• Railway Data Breach: Which Credentials Need to Be Rotated, and What Problems Rotation Cannot Solve