New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619

Searchlight Cyber has published php2shell-scanner, a free open-source utility that checks whether a server is vulnerable to the two pre-auth remote code execution flaws in PHP — CVE-2026-109618 and CVE-2026-109619 — fixed on October 21 and affecting mod_php and PHP-FPM deployments used by WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento. Rather than relying on version banners like most existing scanners, the tool intentionally triggers the same memory-exhaustion condition that underlies the bug, checking for a PHP out-of-memory error or a telltale empty HTTP 500 from a crashed PHP-FPM worker before falling back to a version check as a last resort. Because forcing that OOM state carries some inherent risk to the target host, the researchers warn administrators to run the scanner carefully even though crashed workers typically recover without causing an outage. The tool is available now on GitHub for teams needing to confirm exposure across their PHP infrastructure.