PHP2Shell Scanner: How to Scan Your Servers
Every major vulnerability scanner added checks for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on October 21, 2026. This page lists the plugin IDs, QIDs and template names to look for, what each check really tests, and how to check a single server by hand.
Short answer: for one website, use the free PHP2Shell checker or run php -v. For many servers, run an authenticated scan: Nessus plugin 369483, Qualys QID 389102 or the Nuclei template CVE-2026-109618. Almost all of these checks compare version numbers; none of them proves a server was attacked.
PHP2Shell vulnerability scanner checks
| Scanner | Check | How it decides |
|---|---|---|
| Tenable Nessus | Plugin 369483, PHP < 8.2.35 / 8.3.x < 8.3.36 / 8.4.x < 8.4.27 / 8.5.x < 8.5.12 Multiple Vulnerabilities | Remote; the version PHP reports |
| Tenable Nessus | Plugin 369521 (Gentoo GLSA-202610-02) | Local package check |
| Tenable Web App Scanning | Plugins 115719, 115720, 115721, 115722 (one per PHP branch) | Version based |
| Tenable Cloud Security | Plugins 476508, 476511, 476512 (Alpine), 476454 (Echo) | Container package check |
| Qualys | QID 389102 (PHP2Shell) and QID 39033 (PHP2Shell, unauthenticated) | Not stated for 389102; 39033 is remote |
| Qualys | QIDs 6877310 and 6877311 (Ubuntu USN-8948-1 and -2), 6056502 (RHSA-2026:87080), 290606 (Fedora), 711202 (Gentoo), 6101336 (Arch), 6567432 and 6567434 (Alpine) | Distribution package checks |
| Nuclei (ProjectDiscovery) | Template CVE-2026-109618, "PHP2Shell ... Vulnerable Version Detection" | Passive; reads the X-Powered-By header |
| Rapid7 InsightVM / Nexpose | Checks shipped October 21; IDs not published | Remote, unauthenticated |
| Greenbone / OpenVAS | Enterprise Feed checks for both CVEs; names not published | Authenticated; finds PHP binaries on disk |
| CrowdStrike Exposure Management | Searches for PHP executables on Windows and PHP outside the package manager on Linux | Agent based |
| Datadog Cloud Vulnerability Management | Filter findings by the two CVE IDs | OS packages only |
Qualys QID 45110 and Tenable plugins 48243, 58987, 200476 and 216936 only find PHP; use them to build an inventory, then check versions.
Why version-based PHP2Shell scans can be wrong
- False alarms after patching. Ubuntu, Debian and Red Hat backport the fix and keep the old version number. Ubuntu 24.04 still reports PHP 8.3.6 after the fix. Compare the full package version on the Ubuntu, Debian and RHEL page.
- Missed servers. A remote scan only sees what the server reveals. If
expose_phpis off, there is no version to read. Authenticated or agent scans are more reliable. - The wrong PHP. The command-line
phpcan be a different build from the PHP-FPM or Apache module serving the site. Check the one that serves web requests. - Bundled PHP. Appliances, control panels and portable installs often ship their own PHP. The UK NCSC warns not to stop at the versions your package manager knows about.
Check one server by hand
- Run
php -vto see the command-line version. - For the web server's PHP, put
<?php echo PHP_VERSION;in a temporary file, open it in a browser, then delete the file. - On Debian or Ubuntu, run
dpkg-query -l 'php*'; on RHEL, Rocky or Alma, runrpm -qa 'php*', and compare with your distribution's fixed package. - Compare with the fixed releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Older branches have no upstream fix. Then follow the patch guide.
The PHP2Shell checker on our home page does the same comparison for a public website, using the version it reports.
PHP2Shell detection rules for SIEM and IDS
These rules look for attack traffic or for signs of a break-in, not for an unpatched version. A hit usually means a scan or attempt, not a confirmed compromise.
| Product | Published content |
|---|---|
| Snort (Cisco Talos) | SIDs 67359 and 67360 |
| Suricata (Corelight) | SIDs 3000650, 3000651 and 3000652; the last two only flag affected PHP versions in headers or phpinfo pages |
| Zeek (Corelight) | Package php2shell-detect, installed with zkg; needs Zeek 7.0 or later |
| Palo Alto Networks | Threat Prevention IDs 543004 and 97622 to 97625 |
| Akamai | Rule 3000991, PHP Remote Code Execution Attack Detected |
| CrowdStrike Next-Gen SIEM | Correlation rule template "Generic - Web - PHP Memory Exhaustion During Request Startup" |
| Elastic | Existing web server rules such as Suspicious Web Server Child Process and Unusual File Creation via Web Server; they catch activity after a break-in |
| Splunk, Microsoft Sentinel, SigmaHQ | No official PHP2Shell rule found as of October 21; only unvetted community rules |
If a server was unpatched on October 20 or 21, scan results are only the first step. Use the was I hacked checklist, and see who has reported attacks.
PHP2Shell scanner FAQ
Is there a Nessus plugin for PHP2Shell?
Yes. Nessus plugin 369483 flags PHP below 8.2.35, 8.3.36, 8.4.27 or 8.5.12. It relies on the version PHP reports about itself, so a distribution package with a backported fix can show as vulnerable, and a hidden version can be missed.
What is the Qualys QID for PHP2Shell?
QID 389102 covers PHP2Shell, and QID 39033 is the unauthenticated check. Qualys also has QIDs for the Ubuntu, Red Hat, Fedora, Gentoo, Arch and Alpine advisories.
Is there a Nuclei template for PHP2Shell?
Yes. The official template CVE-2026-109618 is a passive check that reads the PHP version from the X-Powered-By header. It was merged late on October 21, 2026, so run nuclei -ut and confirm you have it.
Is there a Splunk detection for PHP2Shell?
We found no Splunk Security Content detection as of October 21, 2026. Elastic published post-compromise rules, and community Sigma rules can be converted to Splunk searches, but treat community rules as unvetted.
Why does a scanner say I am vulnerable after I patched?
Most scanners compare version numbers. Ubuntu, Debian and Red Hat backport the fix without changing the PHP version, so compare the full package version instead. Also check that the PHP serving your website, not just the command-line PHP, was updated and restarted.