PHP2Shell: from PHP inventory to security updates

Planning a PHP update starts with knowing where PHP runs. Public websites, internal applications, administration panels and container services can belong to different inventories. This page brings together our one-page control bulletin, available in Turkish, and Fox DSS PHP Finder, a tool for collecting PHP signals from web services.

Which systems does PHP2Shell concern?

The PHP security announcement of 21 October 2026 covers installations serving web requests, including PHP-FPM, Apache/mod_php, CGI, FrankenPHP and LiteSpeed. These are the first fixed upstream releases listed in the announcement. Distribution backports require separate verification.

PHP branch	First fixed upstream release
8.2	8.2.35
8.3	8.3.36
8.4	8.4.27
8.5	8.5.12

CVE-2026-109618 concerns invalid internal data used after memory exhaustion; CVE-2026-109619 concerns stale state retained between requests. Both advisories describe remote code execution risks.

A practical update workflow

1. Establish scope. Include internal networks, application hostnames, nonstandard ports and containers alongside public services.
2. Verify the web runtime. Use the management panel, server package inventory or web runtime information. php -v reports only the selected command-line binary.
3. Apply the relevant security update. Treat CMS and plugin updates separately from the PHP runtime. Check vendor patch support for older branches.
4. Restart and verify. Confirm that workers use the updated runtime, check application functions and record the result in the inventory.

The bulletin includes temporary configuration measures for systems that cannot be updated immediately. The OOM advisory discusses memory_limit = -1 alongside resource controls. The stale-state advisory explains where to apply session.upload_progress.enabled=0 and, for PHP 8.5, fatal_error_backtraces=0, followed by worker restarts. These measures provide incomplete protection. Cloudflare WAF protections can add a temporary layer while updates are arranged; direct access to the origin also needs restriction.

Download the Fox DSS PHP2Shell control bulletin (PDF, Turkish)

How to use it

After downloading the file, open a terminal in its folder. Use the tool on systems you own or are authorized to scan.

Windows / PowerShell or CMD

py -3 Fox-DSS-PHP-Finder.py

Linux / Ubuntu / macOS

python3 Fox-DSS-PHP-Finder.py

On Ubuntu, use python3 rather than py -3. The tool then walks through three steps.

1. Choose Internal or External. Enter 1 for the internal label or 2 for external. Both use the connection of the computer running the script. External does not start a remote scanning service.
2. Enter an IP address or CIDR. For example, 192.168.10.0/24. Hostnames are also accepted and supply HTTP Host and HTTPS SNI for virtual hosts.
3. Scan and results. A progress bar is shown during the scan. At the end the tool shows a summary, a table of the services found and the report folder. The CSV file opens in Excel.

On Windows you can also double-click the file. The window stays open until you press Enter, so the results can be read.

How many IP addresses can one scan include?

The default limit is 4096 IP addresses/targets in total, including when multiple targets are supplied. If the limit is exceeded, interactive mode requests a new target. Networks can be scanned separately.

IPv4 network	IP addresses scanned	Default limit
/24	254	Within
/22	1022	Within
/20	4094	Within
/18	16382	Exceeds

If the scope requires a larger network, --max-hosts 16384 increases the limit. The help screen describes port, timeout and concurrency settings.

# Windows
py -3 Fox-DSS-PHP-Finder.py --help

# Linux / macOS
python3 Fox-DSS-PHP-Finder.py --help

Where are the results, and what do they mean?

The default report location is the sonuclar directory next to the script. Mode, target and timestamp each have their own directory. Each run creates a separate folder and preserves previous reports.

sonuclar/
  internal/
    hedef_192.168.10.0_24/
      <timestamp>/
        Fox-DSS-PHP-Finder.csv
        Fox-DSS-PHP-Finder.json

Terminal label (Turkish)	Meaning
PHP sürümü görünen	PHP is declared in Server or X-Powered-By. A disclosed version is recorded.
Olası PHP	A PHPSESSID cookie or .php redirect was observed, no version visible.
PHP izi yok	No PHP evidence in this response.
Web yanıtı yok	The port is open, but no HTTP/HTTPS response was obtained.

For each service with a visible version, the “Ne yapılmalı” (what to do) column compares it with the fixed releases in this bulletin.

Assessment	Meaning
Düzeltilmiş sürüm görünüyor	The visible version is 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
Güncelleme gerekebilir	The visible version is below the fixed release of its branch.
Desteklenmeyen sürüm	PHP 8.1 or older. Upgrade or obtain a vendor patch.
Sürüm gizli	PHP evidence exists but no version is visible. Check on the server.

The default ports are 80, 443, 8000, 8080, 8081, 8443, 8888 and 9000. The tool inspects response headers for / and /index.php. It does not download page bodies or follow redirects. TLS certificates are not verified.

PHP Finder supports preliminary inventory. Headers may be hidden, virtual hosts may require a hostname, and installed PHP may be invisible over the network. Versions are what the server declares, and an absence of evidence does not establish that PHP is absent. Linux distribution packages may carry the fix without changing the version number, so “update may be needed” is not conclusive. The tool does not verify the vulnerability, it only compares the visible version. Final confirmation requires checking the web runtime and distribution package on the server.

Sources

• PHP security announcement, 21 October 2026
• PHP advisory, CVE-2026-109618
• PHP advisory, CVE-2026-109619
• Cloudflare WAF protections for PHP vulnerabilities
• PHP2Shell information page (php2shell.com)

Technical content and the version table were checked on 22 October 2026.