php-guardian 🛡️

Find vulnerable PHP before attackers do. A free, open-source scanner for php2shell (CVE-2026-109618 / CVE-2026-109619), the critical PHP flaws CISA warned about in October 2026.

php2shell lets an attacker run code on any PHP server that handles web requests, with no login needed. CISA's first instruction to organizations: find every PHP install you have. That's harder than it sounds, because PHP often hides inside other software. php-guardian does that inventory step for you.

Part of my security portfolio, alongside VPN Guardian and Wi-Fi Guardian.

What it does

• 🔍 Finds PHP on your PATH and in common hiding spots: Homebrew, MAMP, XAMPP, Laravel Herd, phpenv, Linux packages, cPanel, Remi
• 🧮 Checks each version against the patched releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35
• 🐧 No false alarms on Linux. Ubuntu, Debian, and RHEL often patch PHP without changing its version number. php-guardian checks the package changelog for the CVE fix.
• 🚨 Flags end-of-life PHP (8.1 and older), which CISA says to take offline
• ⚙️ Lists running PHP processes, since web-facing ones get patched first
• 📦 Outputs JSON for SIEMs, scripts, and CI pipelines
• 🙅 Read-only. It only reads version numbers and package changelogs. No exploit code, nothing changed on your system.

Quick start

git clone https://github.com/jeffreyesdavid/php-guardian.git
cd php-guardian
chmod +x php-guardian.sh
./php-guardian.sh

Works on macOS and Linux with plain bash. No installs needed.

Example output

php-guardian 1.1.0 - php2shell check (CVE-2026-109618 / CVE-2026-109619)

  PATCHED-DISTRO 8.3.6    /usr/bin/php8.3
                 -> package php8.3-cli 8.3.6-0ubuntu0.24.04.13 lists the php2shell fix in its changelog
  UNSUPPORTED    8.1.27   /usr/sbin/php-fpm8.1
                 -> PHP 8.1 is end-of-life, CISA says take it offline until upgraded
  PATCHED        8.2.35   /usr/bin/php8.2
                 -> at or above 8.2.35

  Found 3 PHP install(s): 0 vulnerable, 1 unsupported, 1 patched, 1 patched by distro, 0 to review

Why v1.1: I fixed a false positive in my own scanner

v1.0 judged PHP by version number alone. On an Ubuntu 24.04 test machine it flagged PHP 8.3.6 as VULNERABLE, because 8.3.6 is below the fixed 8.3.36.

That was wrong. Ubuntu doesn't jump to new upstream versions; it backports the security patch into the version it already ships. Its package 8.3.6-0ubuntu0.24.04.13 includes CVE-2026-109618_109619.patch, so it was already fixed.

Other php2shell scanners warn about the same trap: a version number can make a patched system look vulnerable. v1.1 now:

1. Finds which package owns each PHP binary (dpkg on Debian/Ubuntu, rpm on RHEL/Rocky/Alma/Fedora/SUSE)
2. Reads that package's changelog for the CVE IDs
3. Reports PATCHED-DISTRO if the fix is there, or keeps it VULNERABLE and names the package if it isn't

Use --strict to turn this off and judge by version number only.

Options

Command	What it does
./php-guardian.sh	Scan PATH and common install locations
./php-guardian.sh --deep	Also search the whole disk (use sudo for full coverage)
./php-guardian.sh --json	Machine-readable output
./php-guardian.sh --check 8.3.10	Check a single version number
./php-guardian.sh --strict	Ignore distro backports, version number only

Exit codes: 0 = nothing vulnerable, 1 = vulnerable or unsupported PHP found, 2 = usage error. That means you can drop it into a CI pipeline or cron job and fail the build when PHP is out of date.

Status meanings

Status	Meaning	Action
🟥 VULNERABLE	Supported branch, below the patched release	Update now, internet-facing first
🟥 UNSUPPORTED	PHP 8.1 or older (end-of-life)	Take offline until upgraded
🟩 PATCHED	At or above the fixed release	You're good
🟩 PATCHED-DISTRO	Older version number, but your distro backported the fix	You're good
🟨 REVIEW	Newer branch than the alert covers	Confirm with the PHP advisory
🟨 UNKNOWN	Couldn't read the version	Check it by hand

Tests

./tests/test_classify.sh
./tests/test_backport.sh

16 tests cover every patch boundary from the CISA alert (for example, 8.3.35 is vulnerable and 8.3.36 is patched). 4 more use a fake PHP binary and fake package managers to check backport detection, without touching your real system.

Limitations

• Doesn't look inside Docker containers or scan remote servers
• Can't see PHP compiled directly into Apache (mod_php)
• Backport detection covers dpkg and rpm. Homebrew, MAMP and similar installs are judged by version number.
• Patched versions come from CISA's alert. Always confirm with the official PHP security advisory.

Roadmap

• v1: find PHP, check versions, JSON output, tests
• v1.1: distro backport detection (no false positives on Ubuntu/Debian/RHEL), --strict flag
• v2: live monitor that sends a phone alert (via ntfy) when a PHP process launches a shell or download tool, the attack behavior CISA says to watch for
• v3: detection rules for Splunk, Elastic, and Sigma
• v4: home lab write-up: catching simulated php2shell behavior in a SIEM

References

• CISA alert: https://go.dhs.gov/5Hi
• CVE-2026-109618, CVE-2026-109619

Disclaimer

Defensive tool for checking systems you own or are authorized to check. Provided as-is, with no guarantees.

License

MIT © 2026 Jeffrey David