In October 2026 two critical PHP vulnerabilities — known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) — were disclosed: remote code execution in the PHP core. For an agency that maintains dozens of websites, the first question is simple and urgent: which of our sites are affected? We built php2shell-checker to answer it quickly, and we published it as open source.
What PHP2Shell is
At its core, the vulnerability lets an attacker run their own code on a server that runs an affected PHP version — in practice, a remote shell. For a public website, that is close to a worst-case scenario: data exposure, defacement, or the server being used as a foothold for further attacks. A patch exists, so the real problem is operational: knowing where you are exposed before someone else finds out.
What the tool does
php2shell-checker is a checker that verifies whether a site or host is exposed to PHP2Shell, so the team knows what to prioritise for patching. It is meant to be run against your own infrastructure — it checks and reports, it does not exploit anything. The point is a clear verdict: affected or not, and therefore what needs attention first.
Why we built it
We maintain a large number of client websites, and checking each one by hand after a disclosure like this is slow and error-prone. A single tool that gives a consistent answer across many sites fits directly into our maintenance and monitoring routine — the same discipline behind the reports and uptime checks we run for clients. When a CVE lands, we want hours, not days, between “is this serious?” and “we know exactly which sites to fix.”
Open source
We published php2shell-checker on GitHub so other teams can use it too: github.com/Nikba-Creative-Studio/php2shell-checker. If you run PHP websites, it is worth checking your exposure now and applying the patch where needed. Security is part of maintenance, not an afterthought — and sharing the tooling is part of how we think it should work.