site/index.html (18567B)
1 <!doctype html>
2 <html lang="en">
3 <head>
4 <meta charset="utf-8">
5 <meta name="viewport" content="width=device-width, initial-scale=1">
6 <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'">
7 <meta name="referrer" content="no-referrer">
8 <meta name="color-scheme" content="light">
9 <meta name="theme-color" content="#ffffff">
10 <title>PHP2Shell exposure check · CVE-2026-109618, CVE-2026-109619</title>
11 <meta name="description" content="Decide whether a server's PHP is affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619) from facts collected on the server. Handles distribution backports, missed restarts and interim mitigations. Runs in your browser.">
12 <meta property="og:type" content="website">
13 <meta property="og:title" content="PHP2Shell exposure check">
14 <meta property="og:description" content="CVE-2026-109618 and CVE-2026-109619, checked from inside the server. Backports, missed restarts and interim mitigations included.">
15 <link rel="alternate" hreflang="en" href="./">
16 <link rel="alternate" hreflang="ko" href="kr/">
17 <link rel="icon" href="favicon.svg" type="image/svg+xml">
18 <link rel="preload" href="fonts/jetbrains-mono-400.woff2" as="font" type="font/woff2" crossorigin>
19 <link rel="stylesheet" href="fonts/pretendard.css">
20 <link rel="stylesheet" href="style.css">
21 <script type="module" src="app.js"></script>
22 </head>
23 <body>
24 <a class="skip" href="#input">Skip to input</a>
25
26 <header class="topbar">
27 <div class="topbar-in">
28 <a class="brand" href="./">
29 <svg viewBox="0 0 32 32" width="22" height="22" aria-hidden="true" focusable="false"><rect width="32" height="32" rx="7" fill="#000"/><path d="M11 24V8h5.5a4.5 4.5 0 0 1 0 9H11" fill="none" stroke="#fff" stroke-width="3.2" stroke-linecap="round" stroke-linejoin="round"/></svg>
30 <span>php2shell-scanner</span>
31 </a>
32 <nav class="cves" aria-label="Advisories">
33 <a href="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" rel="noreferrer">CVE-2026-109618</a>
34 <a href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" rel="noreferrer">CVE-2026-109619</a>
35 </nav>
36 <div class="topbar-end">
37 <a class="lang-toggle" href="kr/" hreflang="ko" lang="ko" aria-label="한국어로 보기" title="한국어로 보기">
38 <svg viewBox="0 0 24 24" width="17" height="17" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m5 8 6 6"/><path d="m4 14 6-6 2-3"/><path d="M2 5h12"/><path d="M7 2h1"/><path d="m22 22-5-10-5 10"/><path d="M14 18h6"/></svg>
39 <span>KR</span>
40 </a>
41 <a class="report-link" href="https://sqzer.com/writing/2026/php2shell-cve-2026-109618-cve-2026-109619/" target="_blank" rel="noopener" aria-label="View report" title="Opens the write-up on sqzer.com in a new tab"><svg viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 3H7a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V8z"/><path d="M14 3v5h5M9 13h6M9 17h6"/></svg><span>View report</span></a>
42 <a class="source" id="repo-link" href="https://github.com/debuman/php2shell-scanner" aria-label="Source on GitHub" title="Source on GitHub">
43 <svg viewBox="0 0 24 24" width="18" height="18" aria-hidden="true" focusable="false"><path fill="currentColor" d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/></svg>
44 </a>
45 </div>
46 </div>
47 </header>
48
49 <main class="workspace">
50 <section class="pane" aria-labelledby="title">
51 <h1 id="title">PHP2Shell exposure check</h1>
52 <p class="lede">Decides whether a server's PHP is affected by CVE-2026-109618 and CVE-2026-109619 from facts collected on the server itself, including distribution backports, missed restarts and interim mitigations. The verdict is computed in this tab; what you paste is not sent anywhere.</p>
53
54 <div class="step">
55 <h2 class="step-head"><span class="step-n">1</span>Collect</h2>
56 <div class="collector">
57 <div class="tabs" role="tablist" aria-label="Collection method">
58 <button class="tab" type="button" role="tab" id="tab-probe" aria-controls="panel-probe" aria-selected="true">PHP probe <span class="tab-hint">recommended</span></button>
59 <button class="tab" type="button" role="tab" id="tab-script" aria-controls="panel-script" aria-selected="false" tabindex="-1">Server script</button>
60 <button class="tab" type="button" role="tab" id="tab-header" aria-controls="panel-header" aria-selected="false" tabindex="-1">Response header</button>
61 </div>
62
63 <div class="tab-panel" role="tabpanel" id="panel-probe" aria-labelledby="tab-probe">
64 <h3 class="panel-title">PHP probe</h3>
65 <div class="get">
66 <a class="btn btn-download" href="downloads/php2shell-selfcheck.php" download aria-label="Download php2shell-selfcheck.php" title="Download"><svg viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3v12m0 0-5-5m5 5 5-5M4 21h16"/></svg>php2shell-selfcheck.php</a>
67 </div>
68 <p class="or">or fetch it on the server</p>
69 <div class="cmdline"><code class="cmd" data-download="php2shell-selfcheck.php">curl -fsSLO https://php2shell.sqzer.com/downloads/php2shell-selfcheck.php</code><button class="copy" type="button" aria-label="Copy command"><svg class="i-copy" viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="9" width="12" height="12" rx="2"/><path d="M5 15V5a2 2 0 0 1 2-2h10"/></svg><svg class="i-check" viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5"/></svg></button></div>
70 <p class="sha" data-sha-for="php2shell-selfcheck.php"></p>
71 <ol class="howto">
72 <li>Set <code>$TOKEN</code> in the file to 12 or more random letters, digits, <code>-</code> or <code>_</code>, for example the output of <code>openssl rand -hex 16</code>.</li>
73 <li>Give the file an unguessable name and upload it to the site's web root.</li>
74 <li>Open <code>https://<site>/<file>.php?k=<TOKEN></code> once. The file then tries to delete itself and says so if it cannot.</li>
75 <li>Repeat per vhost and per PHP-FPM pool; each may run a different PHP.</li>
76 </ol>
77 </div>
78
79 <div class="tab-panel" role="tabpanel" id="panel-script" aria-labelledby="tab-script" hidden>
80 <h3 class="panel-title">Server script</h3>
81 <div class="get">
82 <a class="btn btn-download" href="downloads/php2shell-server-check.sh" download aria-label="Download php2shell-server-check.sh" title="Download"><svg viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3v12m0 0-5-5m5 5 5-5M4 21h16"/></svg>php2shell-server-check.sh</a>
83 </div>
84 <p class="or">or fetch it on the server</p>
85 <div class="cmdline"><code class="cmd" data-download="php2shell-server-check.sh" data-then="sha256sum php2shell-server-check.sh">curl -fsSLO https://php2shell.sqzer.com/downloads/php2shell-server-check.sh && sha256sum php2shell-server-check.sh</code><button class="copy" type="button" aria-label="Copy command"><svg class="i-copy" viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="9" width="12" height="12" rx="2"/><path d="M5 15V5a2 2 0 0 1 2-2h10"/></svg><svg class="i-check" viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5"/></svg></button></div>
86 <p class="sha" data-sha-for="php2shell-server-check.sh"></p>
87 <p class="or">read it, then run it</p>
88 <div class="cmdline"><code class="cmd">sudo sh php2shell-server-check.sh --logs</code><button class="copy" type="button" aria-label="Copy command"><svg class="i-copy" viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="9" width="12" height="12" rx="2"/><path d="M5 15V5a2 2 0 0 1 2-2h10"/></svg><svg class="i-check" viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5"/></svg></button></div>
89 <ol class="howto">
90 <li>POSIX sh, read-only, no network access. Compare the printed hash with the one shown above (also in <a href="downloads/SHA256SUMS">SHA256SUMS</a>) and read the script before you run it.</li>
91 <li>Reports installed PHP packages and the CVE entries in their changelogs, and PHP processes still mapped to files replaced by an update.</li>
92 <li><code class="lit">--logs</code> scans web server, PHP-FPM and kernel logs for indicators; <code class="lit">--webroot DIR</code> lists PHP files changed in the last 3 days.</li>
93 <li>Run as root to inspect processes owned by other accounts.</li>
94 </ol>
95 </div>
96
97 <div class="tab-panel" role="tabpanel" id="panel-header" aria-labelledby="tab-header" hidden>
98 <h3 class="panel-title">Response header</h3>
99 <div class="cmdline"><code class="cmd">curl -sI https://<site>/ | grep -i x-powered-by</code><button class="copy" type="button" aria-label="Copy command"><svg class="i-copy" viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="9" width="12" height="12" rx="2"/><path d="M5 15V5a2 2 0 0 1 2-2h10"/></svg><svg class="i-check" viewBox="0 0 24 24" width="15" height="15" aria-hidden="true" focusable="false" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5"/></svg></button></div>
100 <ol class="howto">
101 <li>Use only when you have no access to the server.</li>
102 <li>Works only if the header is exposed, and describes only the PHP behind that URL.</li>
103 <li>Debian and Ubuntu package revisions in the header are still recognised. Settings, other vhosts and restarts are not visible.</li>
104 </ol>
105 </div>
106 </div>
107 </div>
108
109 <form class="step" id="check-form" novalidate>
110 <div class="step-head-row">
111 <h2 class="step-head"><span class="step-n">2</span><label for="input">Paste output</label></h2>
112 <div class="examples">
113 <select id="example" class="select-sm" aria-label="Example input">
114 <option value="">Choose an example</option>
115 <option value="backport">Ubuntu 22.04, backported fix</option>
116 <option value="restart">Ubuntu 22.04, not restarted</option>
117 <option value="docker">Official Docker image, old tag</option>
118 <option value="rhel">AlmaLinux 9, server script</option>
119 </select>
120 <button type="button" id="load-example" class="btn btn-sm">Load</button>
121 </div>
122 </div>
123 <textarea id="input" rows="12" spellcheck="false" autocomplete="off" autocapitalize="off" placeholder="Probe output (-----BEGIN PHP2SHELL SELFCHECK-----), server script output (-----BEGIN PHP2SHELL SERVERCHECK-----), both, an X-Powered-By header or a version string."></textarea>
124 <div class="form-row">
125 <label class="field">
126 <span>Distribution</span>
127 <select id="distro"><option value="auto">Auto-detect</option></select>
128 </label>
129 <div class="form-buttons">
130 <button type="button" id="clear" class="btn">Clear</button>
131 <button type="submit" class="btn btn-primary">Run check</button>
132 </div>
133 </div>
134 </form>
135 </section>
136
137 <section class="pane pane-result" aria-labelledby="result-title">
138 <div class="step-head-row">
139 <h2 class="step-head" id="result-title"><span class="step-n">3</span>Result</h2>
140 <button type="button" class="btn btn-sm" id="copy-report" hidden>Copy report</button>
141 </div>
142 <noscript><p class="noscript">The check runs as JavaScript in your browser. Enable JavaScript, or compare your PHP by hand with the fixed releases in <a href="data/upstream.json">upstream.json</a> and your distribution's security advisories.</p></noscript>
143 <div id="result">
144 <div class="empty">
145 <p>No result yet. Collect facts on the server, paste the output and run the check.</p>
146 <table class="legend">
147 <caption class="sr-only">Possible verdicts</caption>
148 <tbody>
149 <tr><th scope="row"><span class="badge badge-patched">Patched</span></th><td>At or above the upstream fixed release, or a distribution package carrying both fixes.</td></tr>
150 <tr><th scope="row"><span class="badge badge-vulnerable">Vulnerable</span></th><td>Below the fixed release, including upstream builds of end-of-life branches.</td></tr>
151 <tr><th scope="row"><span class="badge badge-pending">Fix pending</span></th><td>The distribution tracks the CVEs but has not shipped a fixed package.</td></tr>
152 <tr><th scope="row"><span class="badge badge-restart">Restart needed</span></th><td>The fixed package is installed; the running PHP is still the old build.</td></tr>
153 <tr><th scope="row"><span class="badge badge-unknown">Undetermined</span></th><td>Not enough evidence. Never reported as safe.</td></tr>
154 </tbody>
155 </table>
156 </div>
157 </div>
158 </section>
159 </main>
160
161 <section class="reference" aria-labelledby="ref-title">
162 <div class="reference-in">
163 <div class="ref-col">
164 <h2 id="ref-title">Affected releases</h2>
165 <noscript><p class="noscript">The release and package tables need JavaScript. Enable it, or read the data in <a href="data/upstream.json">upstream.json</a> and <a href="data/distro.json">distro.json</a> directly.</p></noscript>
166 <table class="data" id="upstream-table">
167 <thead><tr><th scope="col">Branch</th><th scope="col">Affected</th><th scope="col">Fixed</th></tr></thead>
168 <tbody></tbody>
169 </table>
170 <details class="disclosure">
171 <summary>Distribution packages</summary>
172 <table class="data" id="distro-table">
173 <thead><tr><th scope="col">Distribution</th><th scope="col">Source package</th><th scope="col">Fixed in</th></tr></thead>
174 <tbody></tbody>
175 </table>
176 </details>
177 <details class="disclosure">
178 <summary>Red Hat advisories</summary>
179 <div id="redhat-list"></div>
180 </details>
181 <p class="fine" id="data-status"></p>
182 </div>
183
184 <div class="ref-col">
185 <h2>Method</h2>
186 <ol class="method">
187 <li>A version at or above the upstream fixed release for its branch is patched.</li>
188 <li>Debian and Ubuntu packages are compared with the distribution's fixed version using dpkg ordering.</li>
189 <li>On the RHEL family the evidence is the CVE entries in the package changelog, collected by the server script.</li>
190 <li>A running version older than the installed package, or a PHP process mapping a deleted file, means restart needed.</li>
191 <li>deb.sury.org builds, official Docker images and self-built PHP are judged against upstream releases.</li>
192 <li>Interim mitigations are reported but never change a verdict.</li>
193 <li>Missing evidence gives Undetermined, never safe.</li>
194 </ol>
195 <h2>Scope</h2>
196 <p class="fine-block">No request is sent to your server. The probe reads versions, packages and settings. The server script also reads package changelogs, the process list with command lines, the files each PHP process has mapped and PHP and web server configuration files. With <code class="lit">--logs</code> and <code class="lit">--webroot</code> it also reads logs, session file sizes and the names and dates of PHP files. Its terminal output can show command lines and log lines; the page needs only the block between the BEGIN and END lines.</p>
197 <p class="fine-block">A verdict is not proof that an attack would fail. Read the upstream advisories and your distribution's notices as well.</p>
198 </div>
199 </div>
200 </section>
201
202 <footer class="footer">
203 <p>php2shell-scanner · MIT · <a class="repo-link" href="https://github.com/debuman/php2shell-scanner">Source</a> · <a href="data/distro.json">distro.json</a> · <a href="data/upstream.json">upstream.json</a> · <a href="downloads/SHA256SUMS">SHA256SUMS</a> · by <a href="https://sqzer.com">Hyukjin An</a></p>
204 </footer>
205 </body>
206 </html>