title: PHP2Shell: processes still running a replaced PHP binary
agents: linux
catalog: app/php
license: GPL-2.0-only
distribution: php2shell
description:
 This check counts processes that still have a PHP binary or libphp mapped
 that has been deleted on disk - typically because PHP was updated, but
 PHP-FPM or the web server was not restarted. These processes still run the
 old, possibly vulnerable code, so a fixed version on disk alone does not
 protect against CVE-2026-109618 / CVE-2026-109619.

 The service is {CRIT} if there is at least one such process, configurable
 with the rule "PHP2Shell restart". Processes inside containers are not
 considered.

 It evaluates the {php2shell} section of the agent plug-in shipped with
 this MKP. Since the plug-in runs cached, the service turns {OK} at the
 latest one cache interval after the restart.

discovery:
 One service is created on every host on which the agent plug-in finds PHP.
