CLAYMONT, Del., Oct. 23, 2026 /PRNewswire/ -- Astra Security today released two free resources for organizations responding to PHP2Shell, the critical PHP vulnerabilities disclosed this week. The first is a public-URL PHP2Shell Checker. The second is php2shell-triage, an open-source skill for deeper investigation.

The flaws, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 on CVSS v4.0 and can allow unauthenticated remote code execution through PHP's core runtime. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP runs across websites, CMS platforms, custom applications and vendor-managed infrastructure, so many organizations will need to look beyond the applications they maintain directly.

Start with what's public: Scan Public Assets with the PHP2Shell Checker

The PHP2Shell Checker compares the PHP version a public website appears to serve against the fixed releases. It needs no account. The result is a first signal, not a verdict: proxies, hosting providers and server settings can hide or alter version information, and a clean result says nothing about internal systems.

Go deeper on systems you run: Assess Internal Systems with php2shell-triage

php2shell-triage helps teams assess PHP runtimes across server APIs, flag stale workers, look for indicators of exploitation, and plan remediation for PHP vulnerabilities. Its read-only script inspects the binaries behind running PHP workers instead of trusting the command-line version. That catches servers that report a patched PHP while old workers are still serving the vulnerable runtime, preventing unauthenticated remote code execution (RCE).

How to Fix PHP2Shell: Immediate Remediation Steps

Identify affected installations, apply updates, restart PHP workers, and verify that the patched runtime is running. Where compromise is suspected, capture evidence before restarting. End-of-life versions (8.1 and earlier) will not receive official fixes and need an upgrade plan. Where patching isn't immediately possible, consider isolating vulnerable systems.

"During a disclosure like PHP2Shell, the hardest question isn't 'Are we vulnerable?' It's 'What is actually running right now?'" said Shikhil Sharma, Founder & CEO at Astra Security.

Free tools

PHP2Shell guidance

PHP2Shell technical advisory
PHP2Shell security checklist: what to ask your vendors

Related advisories from this week

LiteLLM supply-chain attack
GitLab CVE-2026-110264, a critical CVSS 10.0 regex RCE
Node.js October 2026 security patches
Railway breach: what to rotate and what rotation won't fix

Watch

PHP2Shell explained (video by The Social Dork)

View original content to download multimedia:https://www.prnewswire.co.uk/news-releases/astra-security-releases-free-tools-to-help-organizations-find-and-fix-php2shell-vulnerabilities-302918212.html

Images

Tags

More Like This

Over 16,400 Private and State-Owned Businesses Exposed to RegreSSHion Vulnerability

Intruder’s 2025 Exposure Management Index: SMBs Face Rising Risk as AI Weaponizes Older CVEs

Second Annual Synack State of Vulnerabilities Report Uncovers Spike in Severity, Progress in Remediation

Intruder Releases 2026 Attack Surface Management Index: 1 in 4 Organizations Have Exposed MySQL Databases

HCLSoftware Launches HCL AppScan API Security

Veracode Reveals Half of Organizations Burdened by Critical Security Debt, with 70% Stemming from Third-party Code and the Software Supply Chain

Patch My PC Launches Security Application for Risk-Based Vulnerability Prioritization and Remediation Tracking

Public Sector Application Risk Accumulates as Security Debt Grows Across Government Systems