# Php2shell - a check for CVE-2026-109618-19

**URL:** <https://discourse.homelabbrisbane.com.au/t/php2shell-a-check-for-cve-2026-109618-19/563>\
**Category:** Software\
**Tags:** security\
**Created:** [October 22, 2026, 10:24pm UTC](https://discourse.homelabbrisbane.com.au/t/php2shell-a-check-for-cve-2026-109618-19/563 "2026-10-22T22:24:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zeeclor](https://discourse.homelabbrisbane.com.au/user_avatar/discourse.homelabbrisbane.com.au/zeeclor/32/3_2.png) [@zeeclor](https://discourse.homelabbrisbane.com.au/u/zeeclor)\
**Post date:** [October 22, 2026, 10:24pm UTC](https://discourse.homelabbrisbane.com.au/t/php2shell-a-check-for-cve-2026-109618-19/563/1 "2026-10-22T22:24:12Z")

</div>

I checked my servers today with the php2shell script for the recent [php vulnerability](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php). I found that Joomla, Mailcow, Grocy and Barcode Buddy were vulnerable. There were fixes for Joomla and Mailcow. There will presumably be a fix for Grocy at some stage. Barcode Buddy is no longer maintained.

I also found that the HLB homepage was vulnerable but that too has been fixed.

```auto
!/usr/bin/env bash
# php2shell-check.sh — list running containers that ship PHP, with versions.
# PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is fixed upstream in
# PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Run this on each Docker host.
set -u

for id in $(docker ps -q); do
  name=$(docker inspect -f '{{.Name}}' "$id"); name=${name#/}
  image=$(docker inspect -f '{{.Config.Image}}' "$id")
  envver=$(docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' "$id" \
           | sed -n 's/^PHP_VERSION=//p')

  found=$(docker exec "$id" sh -c '
    for f in /usr/bin/php* /usr/sbin/php-fpm* /usr/local/bin/php \
             /usr/local/sbin/php-fpm /usr/local/bin/frankenphp; do
      [-x "$f"] || continue
      case "$f" in *-config*|*ize*|*dbg*) continue;; esac
      v=$("$f" -v 2>/dev/null | head -n1)
      [-n "$v"] && echo " bin: $f -> $v"
    done
    if command -v dpkg-query >/dev/null 2>&1; then
      dpkg-query -W -f="\${Package} \${Version}\n" "*php*" 2>/dev/null \
        | grep -E "^(php[0-9.]*-(fpm|cli|common)|libapache2-mod-php[0-9.]*) " \
        | sed "s/^/ pkg: /"
    elif command -v apk >/dev/null 2>&1; then
      apk info -v 2>/dev/null \
        | grep -E "^php[0-9]*-((fpm|cli|common)-)?[0-9]" \
        | sed "s/^/ pkg: /"
    fi
    exit 0' 2>/dev/null)
  rc=$?

  if [$rc -ne 0]; then
    echo "?? $name ($image): no shell in container — check the image manually${envver:+ (PHP_VERSION=$envver)}"
  elif [-n "$found"] || [-n "$envver"]; then
    echo "!! $name ($image)${envver:+ PHP_VERSION=$envver}"
    [-n "$found"] && echo "$found"
  fi
done

```

---

<div class="post-metadata">

**Author:** ![Belfry](https://discourse.homelabbrisbane.com.au/user_avatar/discourse.homelabbrisbane.com.au/belfry/32/501_2.png) [@Belfry](https://discourse.homelabbrisbane.com.au/u/Belfry)\
**Post date:** [October 22, 2026, 11:18pm UTC](https://discourse.homelabbrisbane.com.au/t/php2shell-a-check-for-cve-2026-109618-19/563/2 "2026-10-22T23:18:18Z")

</div>

Top work getting onto the HLB stuff so quickly, @zeeclor.

Thanks for posting the check as well. Will have to double check a few internal things over the next day or two!