Open-source tool probes PHP servers for critical remote-code-execution flaws
Searchlight Cyber released an open-source scanner for two PHP remote code execution vulnerabilities patched on October 21. The tool tries to trigger memory exhaustion and observe server behavior rather than relying only on version banners, which the researchers say can miss vulnerable configurations. It is intended to help administrators identify hosts still exposed to the PHP2Shell flaws.
Searchlight Cyber’s php2shell-scanner is a free GitHub utility for checking whether hosts remain exposed to CVE-2026-109618 and CVE-2026-109619, fixed on October 21. PHP2Shell allows unauthenticated code execution when PHP runs through Apache mod_php or PHP-FPM in default setups; exploitation has been confirmed on WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento.
The scanner first attempts to force a memory-exhaustion error, then looks for an empty HTTP 500 response indicating a PHP-FPM worker died during a request, and only then checks the advertised PHP release. Its probes include a small control request and up to three multipart requests with deeply nested array keys, scaling from 1 MiB to 20 MiB; testing stops once a result is clear.
Organizations running PHP-based sites and applications—including common content-management and administrative platforms—may be affected if hosts remain unpatched. A reliable scanner could help administrators find exposed systems faster and reduce the window for attackers, though deliberate memory-exhaustion probes could briefly disrupt individual workers. Because these platforms are widely deployed, even partial exposure may create broad operational and data-security concerns for site owners, service providers, and their users.