Vulnerability check
How MyPentest checks for PHP2Shell
A passive check for PHP2Shell uses a disclosed PHP version to identify systems that may need attention. It does not execute an exploit.
What is PHP2Shell?
PHP2Shell refers to two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow remote code execution in affected environments. The PHP project released security updates; check your distribution or hosting provider for the appropriate fix. See the PHP Foundation security announcement.
What happens during a scan
- 01
Read the response
During an authorized scan, MyPentest examines responses already received from the target. It looks for a PHP version disclosed in the X-Powered-By header.
- 02
Compare the version
The identified version is compared offline with the loaded advisory catalogue for CVE-2026-109618 and CVE-2026-109619. If it falls within an affected range, MyPentest can flag it for review.
- 03
Review the evidence
A version match is a likely finding, not proof of exploitation. The report identifies the advisory and observed version, with context to help you verify the installed build and vendor fix.
What this check cannot tell you
- A hidden or absent PHP version cannot be matched. No finding is not proof that your site is safe.
- Headers can be inaccurate, and providers may backport security fixes without changing the upstream version. Verify the installed package and your provider's advisory.
- The check does not send an exploit or confirm remote code execution. It cannot verify every deployment condition or every server behind a proxy.
- Results depend on the loaded intelligence snapshot. The advisory catalogue is partial and its freshness matters.
If a finding appears
Confirm the PHP version and package actually serving the application. Review the PHP and vendor advisories, apply the appropriate security update, and assess the system again. For sites with no disclosed version, check the deployment directly or ask the hosting provider.
← Back to MyPentestRun a real pentest on your app - free.
Sign in, prove you own the domain, and MyPentest maps and tests it. No credit card.