Vidoc Security Lab - home page
PlatformFindings, reports and repositories for code security in one placeAI Security EngineerReviews every pull request and proposes fixes for confirmed vulnerabilitiesIntegrationsWorks in GitHub, GitLab, Bitbucket, CI/CD pipelines and SlackBusiness ContextUses how your system is built to decide what matters
PHP2Shell
Research
BlogSecurity insights, updates and moreGuidesPractical guides to code securityFAQAnswers to frequent questionsDocumentationHow to use VIDOCSecurityHow we protect your code and data
AboutMeet the teamCareersFind your role at VIDOCContactGet in touch with our teamRequest demoSee VIDOC in action
The most cyber-capable open model, for defenders. Try now >>

PHP2Shell · CVE-2026-109618 · CVE-2026-109619

Check your PHP exposure

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP servers without logging in. VIDOC's free script finds potentially affected PHP installations across your environment, including the internal apps an external scan can't reach. Fill out the form to get the script and run instructions.

Your details go to our team, nowhere else. Read the Privacy Policy

CVSS 9.2 — CriticalUnauthenticated RCEWordPress, Drupal, Joomla, MagentoExploited in the wildAbout 1.5 million servers unpatched
CVSS 9.2 — CriticalUnauthenticated RCEWordPress, Drupal, Joomla, MagentoExploited in the wildAbout 1.5 million servers unpatched
CVSS 9.2 — CriticalUnauthenticated RCEWordPress, Drupal, Joomla, MagentoExploited in the wildAbout 1.5 million servers unpatched
CVSS 9.2 — CriticalUnauthenticated RCEWordPress, Drupal, Joomla, MagentoExploited in the wildAbout 1.5 million servers unpatched

Why check your
PHP environment?

PHP2Shell sits in the PHP engine itself, so your login page and application code can’t stop it. PHP may power more of your stack than you think: WordPress sites, intranets, billing tools. Know where it runs before attackers do.

WordPressPHP
IntranetPHP
BillingPHP

Does this check replace
a security update?

No. The script helps assess potential exposure. It does not patch PHP or replace verification of your installed version and security updates.

Exposure checkOK
Security update

Frequently Asked Questions

Check your exposure to PHP2Shell

Get the free VIDOC script to check your environment.