PHP2Shell Pre-Auth RCE Readiness & SAPI Mitigation Scanner (CVE-2026-109618 / 109619)
“Audit PHP Runtimes, Containers & Apache SAPI Configs Against PHP2Shell (CVE-2026-109618 & CVE-2026-109619) with Zero Dependencies.”
Zero-dependency Python 3 defensive readiness auditor for critical PHP2Shell out-of-memory RCE vulnerabilities (CVSS v4.0 9.2). Verifies patched runtime builds, detects Apache mod_php + RLimitMEM heap hazards, scans .htaccess/user.ini memory_limit overrides, and generates hardened php.d drop-ins.
CLAIM: Zero-dependency PHP2Shell (CVE-2026-109618 / CVE-2026-109619) runtime, Dockerfile, and SAPI readiness auditing. PROOF: Deterministic Python scanner (skills/php2shell-vulnerability-scanner/php2shell_scanner.py --selftest PASS).
How do we verify our fleet is protected against the critical PHP2Shell pre-auth out-of-memory RCE vulnerabilities (CVE-2026-109618 / CVE-2026-109619)?
Aria’s PHP2Shell Readiness & Mitigation Scanner inspects live PHP runtimes, Dockerfiles, composer.json manifests, Apache mod_php RLimitMEM configurations, and .htaccess overrides against patched minimum builds (8.5.12, 8.4.27, 8.3.36, 8.2.35) and outputs drop-in php.d mitigation configs.
Production Stack
Proven Production Guarantees
- Audits PHP 8.2, 8.3, 8.4, and 8.5 runtimes and container manifests against exact patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35).
- Detects high-risk Apache prefork mod_php + RLimitMEM combinations and unguarded .htaccess memory_limit overrides.
- Generates ready-to-deploy php.d hardening configurations and exits non-zero in CI/CD pipelines when vulnerable targets are found.
Implementation & Verification Runbook
Execute the zero-dependency scanner self-test to verify PHP version matrix checks, mod_php RLimitMEM detection, and mitigation generation.
python skills/php2shell-vulnerability-scanner/php2shell_scanner.py --selftest