On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 collectively known as PHP2Shell. Both can allow unauthenticated remote code execution on any PHP installation that serves web requests, including PHP-FPM, Apache with mod_php, and php-cgi. Attackers could use these flaws to take over anything running PHP, from websites to IoT devices on a local network.
We emailed all HostedScan subscribers about these vulnerabilities on the same day. This post tracks when each HostedScan scanner can detect them. We will update the list below as scanner updates pass our testing.
What to do
Update PHP now. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both vulnerabilities. PHP 8.1 and older get no fixes from the PHP project but are still vulnerable. Check with your Linux distribution or LTS vendor for patched packages.
The PHP security advisory has the full details and the temporary mitigations for servers that cannot update right away. The PHP project says the mitigations reduce exposure but do not make an installation safe.
Scanner status
These listed scanners now have a detection test active in HostedScan for PHP2Shell.
- Tenable Nessus now includes detection tests for both CVEs for remote and local checks
- Nuclei has merged a version header check and active payload test.
- OpenVAS and Greenbone Enterprise include a version check for authenticated internal scans.
- ZAP has also included a passive check for the reported header version.
Note that a lack of a scan detection does not guarantee a server is clear of the vulnerable PHP version.
Nuclei
External scan
Available in HostedScanExternal scanAvailable in HostedScanTenable Nessus
External scan
Available in HostedScanExternal scanAvailable in HostedScanTenable Nessus
Internal scan
Available in HostedScanInternal scanAvailable in HostedScanTenable Nessus
Internal authenticated scan
Available in HostedScanInternal authenticated scanAvailable in HostedScanTenable Nessus Agent
Internal authenticated scan
Available in HostedScanInternal authenticated scanAvailable in HostedScanOpenVAS
Internal authenticated scan
Available in HostedScanInternal authenticated scanAvailable in HostedScanGreenbone Enterprise
Internal authenticated scan
Available in HostedScanInternal authenticated scanAvailable in HostedScanOWASP ZAP
External scan
Available in HostedScanExternal scanAvailable in HostedScan
Sources
- 01PHP security advisory, October 21, 2026php.net
- 02Nuclei - Update CVE ID in CVE-2026-109618.yamlgithub.com
- 03Nuclei - Added CVE-2026-109618 - Version Detectiongithub.com
- 04Tenable plugins for CVE-2026-109618tenable.com
- 05Tenable plugins for CVE-2026-109619tenable.com
- 06ZAP - Detecting PHP2Shell and Other PHP Vulnerabilities with ZAPzaproxy.org
Speed and power,
without the complexity
The world's leading vulnerability scanners, all in one platform.