Release: local checker for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

CovertSwarm has released an Open Source script that tells you whether a server is vulnerable to the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. It’s on GitHub now: covertswarmlabs/PHP2Shell-local-checker.

What it does

php2shell_local_checker.py is a lightweight, single-file diagnostic tool. A system administrator runs it directly on the server and gets a definitive answer: vulnerable, patched, or partially protected.

It doesn’t try to determine the vulnerabilities from an external perspective. Firewalls, proxies, and privacy settings can hide the truth from an outside scan. Instead, the script inspects the actual PHP installations on the machine. It checks for a specific technical fingerprint left behind by the security fix, reviews configuration settings, and looks inside running Docker containers.

The output is a clear verdict. For teams that need to process results at scale, it also produces a structured report in JSON format.

Safe to run

The entire tool is read-only. It changes nothing on the system, sends no network traffic, and contains no exploit code. You can hand it to clients or run it in production environments with minimal risk. Run it at your own risk.

Get it

Download the script from GitHub and run it on any server with PHP installed.