I checked my servers today with the php2shell script for the recent php vulnerability. I found that Joomla, Mailcow, Grocy and Barcode Buddy were vulnerable. There were fixes for Joomla and Mailcow. There will presumably be a fix for Grocy at some stage. Barcode Buddy is no longer maintained.
I also found that the HLB homepage was vulnerable but that too has been fixed.
!/usr/bin/env bash
# php2shell-check.sh — list running containers that ship PHP, with versions.
# PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is fixed upstream in
# PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Run this on each Docker host.
set -u
for id in $(docker ps -q); do
name=$(docker inspect -f '{{.Name}}' "$id"); name=${name#/}
image=$(docker inspect -f '{{.Config.Image}}' "$id")
envver=$(docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' "$id" \
| sed -n 's/^PHP_VERSION=//p')
found=$(docker exec "$id" sh -c '
for f in /usr/bin/php* /usr/sbin/php-fpm* /usr/local/bin/php \
/usr/local/sbin/php-fpm /usr/local/bin/frankenphp; do
[ -x "$f" ] || continue
case "$f" in *-config*|*ize*|*dbg*) continue;; esac
v=$("$f" -v 2>/dev/null | head -n1)
[ -n "$v" ] && echo " bin: $f -> $v"
done
if command -v dpkg-query >/dev/null 2>&1; then
dpkg-query -W -f="\${Package} \${Version}\n" "*php*" 2>/dev/null \
| grep -E "^(php[0-9.]*-(fpm|cli|common)|libapache2-mod-php[0-9.]*) " \
| sed "s/^/ pkg: /"
elif command -v apk >/dev/null 2>&1; then
apk info -v 2>/dev/null \
| grep -E "^php[0-9]*-((fpm|cli|common)-)?[0-9]" \
| sed "s/^/ pkg: /"
fi
exit 0' 2>/dev/null)
rc=$?
if [ $rc -ne 0 ]; then
echo "?? $name ($image): no shell in container — check the image manually${envver:+ (PHP_VERSION=$envver)}"
elif [ -n "$found" ] || [ -n "$envver" ]; then
echo "!! $name ($image)${envver:+ PHP_VERSION=$envver}"
[ -n "$found" ] && echo "$found"
fi
done