🔍
PHP2SHELL
CVE-2026-109618 / CVE-2026-109619
AI AGENT
CVSS 9.2
PHP2SHELL
CRITICAL
⚡ PHP Detector
🌐 DNS Hygiene
Scan Target
⚙ Options
SCAN ▶
Deep paths
FastCGI TCP
Headers only
Timeout
s
PHP2Shell Ultimate — CVE-2026-109618/109619
UNKNOWN
—
CVE-2026-109618
CVE-2026-109619
9.2
CRITICAL — PHP NOT PATCHED
PHP session.upload_progress UAF race condition — remote code execution without authentication. Patch: upgrade PHP or set
session.upload_progress.enabled=0
.
✓
PHP version is patched — CVE-2026-109618/109619 not applicable.
?
PHP version unknown — CVE exposure indeterminate. PHP presence:
not confirmed
.
▶
Definite Findings
0
▶
CMS Detected
0
▶
Method Probe
▶
Session / Easter Egg
⎘ Copy raw JSON
💀
RCE Exploit Probe — Active Testing
preflight
uaf race
rce exec
webshell
▶ LAUNCH
dtor addr
zval_ptr_dtor (hex) — required for rce exec
— auto-fill profile —
── Ubuntu 22.04 ──
PHP 8.1.2 (Ubuntu 22.04 pkg)
PHP 8.2.x (Ubuntu 22.04 pkg)
── Ubuntu 20.04 ──
PHP 8.1.x (Ubuntu 20.04 ondrej)
── Debian 11/12 ──
PHP 8.1.x (Debian 11 pkg)
PROBE OUTPUT
⎘ COPY
CLEAR
🐚
Interactive Shell
✕ KILL
$
⏎ RUN
Recent Scans
Domain
CHECK DNS
Check
Status
Detail
—
security score