v0.1.4: older branches have no release, but PHP published source backports

Accuracy fix: older PHP branches have no upstream release, but PHP did publish source backports. No change in detection behavior.

• PHP's maintainers pushed official source backports for 7.4, 8.0 and 8.1 as branches in php-src (PHP-8.1-CVE-2026-109618-109619 and the 8.0 and 7.4 equivalents, 2026-10-18), with no releases. Earlier versions of this tool and its docs said those branches had "no upstream fix". That was wrong; it is "no upstream release".
• The tool's messages, its "What to do" block, its references, the README and the site now say so. 7.3 and older get nothing: upgrade.
• A build made from the backport branches still reads as vulnerable, because its version number does not change. The README says so.
• Advisory data re-checked on 2026-10-23.

Download php_vuln_check.py below (single file, no dependencies) and check it against SHA256SUMS, or pipx install git+https://github.com/ethoic-inc/php-vuln-check.

v0.1.3: Ubuntu containers, FPM pool settings

Docker containers built on Ubuntu now get a real answer instead of REVIEW, and the mitigation advice follows PHP's own advisory.

• Ubuntu fixed builds. Ubuntu fixed PHP2Shell without changing the PHP version (24.04 stays on 8.3.6; the fix is 8.3.6-0ubuntu0.24.04.13), and Docker's ubuntu and debian images strip the package changelog. scan now compares the package with the fixed builds in USN-8948-1, on the same build line only, so Sury or other-release builds are never judged against it. Tested on a stock ubuntu:24.04 container in CI.
• PHP-FPM pool settings. scan reads php_value / php_admin_value overrides for memory_limit, session.upload_progress.enabled and fatal_error_backtraces from the pool configs, shown as pool www: memory_limit=-1.
• Mitigations in PHP's order. memory_limit=-1 in admin config first, then session.upload_progress.enabled=0 (and fatal_error_backtraces=0 on PHP 8.5), and blocking multipart only for applications that take no uploads.
• Stale-data warning. Every report warns when the advisory data is more than 30 days old.

Full list: CHANGELOG.md.

v0.1.2: primary-source advisories

The fix table is now confirmed against PHP's own advisories, and the docs say exactly what those advisories do and do not cover. No change in detection behavior.

• Primary sources. GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) both list 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as the patched releases. They are now the first references in the tool, in the SARIF help links, in the README and on the site. The newest official php Docker image in each branch matches.
• Honest wording about older branches. PHP's advisories cover 8.2 to 8.5 only. The README, site and code now say the PHP 5.4 start of the affected range is Sansec's claim, and advise treating 8.1 and older as vulnerable unless the vendor changelog names both CVEs.
• Copyright holder is Ethoic Inc; Code of Conduct added.
• Tests: 91 to 95, including an invariant test that PATCHED never appears without evidence.

Download php_vuln_check.py below (single file, no dependencies) and check it against SHA256SUMS, or pipx install git+https://github.com/ethoic-inc/php-vuln-check.

v0.1.1: now an Ethoic Inc project

php-vuln-check now lives in the ethoic-inc GitHub organization, an open-source project from Ethoic Inc. No change in behavior from 0.1.0.

• Project, Pages, Action and pre-commit URLs point at github.com/ethoic-inc/php-vuln-check and ethoic-inc.github.io/php-vuln-check. The old repository and download URLs redirect.
• Attribution and a public contact address (hello@ethoic.com) added to the README, the site and the package metadata.
• GitHub Action: use ethoic-inc/php-vuln-check@v0.1.1. Pre-commit: rev: v0.1.1.

Download php_vuln_check.py below (single file, no dependencies) and check it against SHA256SUMS, or pipx install git+https://github.com/ethoic-inc/php-vuln-check. See the 0.1.0 notes for what the tool does and how it was tested.

v0.1.0: PHP2Shell checker

First public release. Built the week PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was disclosed.

php-vuln-check finds PHP installs exposed to PHP2Shell on servers, Docker images, Kubernetes and CI, without sending exploit traffic.

• scan: PHP CLI, FPM, CGI, LiteSpeed and Apache mod_php on a host. Version, SAPI, owning package, Debian and RPM changelog backport evidence, and a restart warning when running processes still use a replaced PHP file.
• images: Dockerfiles, compose files, Kubernetes manifests, running containers (--docker) and every pod in a cluster (--kubectl).
• fleet: run scan on many hosts over SSH, nothing installed there.
• url: the version a site advertises (never PATCHED: a banner proves nothing).
• Text, JSON, CSV and SARIF output. GitHub Action for CI gating and code scanning.

Tested on real PHP packages in Debian 12 and 13, Ubuntu 20.04 to 24.04, AlmaLinux 8 and 9, Rocky 9, Fedora, Amazon Linux, Alpine and the official PHP images, and the unit tests run on Python 3.6 to 3.13. It was reviewed independently for security before release, and the findings were fixed (see CHANGELOG).

Download php_vuln_check.py below (single file, no dependencies) and check it against SHA256SUMS, or pipx install git+https://github.com/jake-bowser/php-vuln-check.

New tool: please report anything it gets wrong, especially on RHEL-family systems and third-party PHP repositories.