title: PHP2Shell: PHP installations affected by CVE-2026-109618 / CVE-2026-109619
agents: linux
catalog: app/php
license: GPL-2.0-only
distribution: php2shell
description:
 This check reports whether a PHP installation on the host is affected by
 the "PHP2Shell" remote code execution vulnerabilities CVE-2026-109618 and
 CVE-2026-109619.

 It evaluates the {php2shell} section of the agent plug-in shipped with
 this MKP (deploy it via the "PHP2Shell agent plug-in" bakery rule, or copy
 it to the host manually with a cache interval, e.g. {plugins/3600/}).

 A PHP version counts as fixed if it is at least the upstream fix of its
 branch (8.2.35, 8.3.36, 8.4.27, 8.5.12; newer branches are fixed), or if
 the changelog of the package that owns the binary names both CVEs - the
 way Debian, Ubuntu, RHEL and their derivatives backport fixes without
 changing the upstream version. Branches before 8.2 have no upstream fix.

 A vulnerable FPM, CGI, LiteSpeed, Apache module or embedded libphp (NGINX
 Unit, FrankenPHP) installation is {CRIT}.
 It is {WARN} if the interim mitigations are active in the php.ini of this
 SAPI: {memory_limit=-1} (CVE-2026-109618) and
 {session.upload_progress.enabled=Off}, on PHP 8.5 also
 {fatal_error_backtraces=Off} (CVE-2026-109619). A vulnerable CLI binary
 is {WARN}, since it does not serve HTTP requests by itself. All states
 can be changed with the rule "PHP2Shell (CVE-2026-109618 /
 CVE-2026-109619)".

 A fixed installation with {session.upload_progress.enabled=On} shows a
 hint on the not yet fixed CVE-2026-115560 (state configurable, default
 {OK}).

item:
 The path of the PHP binary or library, e.g. {/usr/sbin/php-fpm8.3}.

discovery:
 One service is created for each PHP binary and PHP library (Apache module,
 libphp of NGINX Unit or FrankenPHP) the agent plug-in finds.
