A read-only, open-source checker for PHP2Shell fixes across installed PHP packages on Debian 12 and 13."
You update PHP, run php -v, and see a patched version.
But which PHP version is actually serving your websites?
A server can have multiple PHP branches installed. Your default CLI binary might be current while a website still uses an older PHP-FPM pool. Checking one version leaves a practical gap.
That is the problem behind PHP2Shell Checker, a small open-source tool I built with Codex while working through the update process for my Debian servers.
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities that can allow unauthenticated remote code execution. The PHP project released fixes on October 21, 2026, and recommends updating immediately. The advisory covers web-serving installations including PHP-FPM, Apache mod_php, CGI, FrankenPHP, and LiteSpeed. Official PHP advisory.
For the standard Debian packages, the fixed versions are:
| Distribution | PHP branch | Fixed package version |
|---|---|---|
| Debian 12 — bookworm | PHP 8.2 | 8.2.35-1~deb12u1 |
| Debian 13 — trixie | PHP 8.4 | 8.4.27-1~deb13u1 |
These thresholds are documented in Debian's security advisories: DLA-4848-1 and DSA-6574-1.
The checker brings the relevant package information into one report. It:
- Inventories recognized PHP core packages across installed branches, including CLI, FPM, CGI, and Apache mod_php.
- Compares installed versions against known fixed thresholds.
- Shows the candidate versions available through APT.
- Identifies held packages that may block updates.
- Searches common installation directories for PHP runtimes outside the assessed packages.
- Prints suggested update commands when a newer, verified fixed candidate is available.
It runs locally, uses the Python standard library, and requires no external Python packages. The checker itself makes no network requests and performs no system changes. It does not execute PHP binaries or attempt to exploit the vulnerabilities.
To use it on Debian 12 or 13:
git clone https://github.com/toxy4ny/php2shell-checker.git
cd php2shell-checker
# Refresh APT's package information separately.
sudo apt update
# Run the checker.
python3 check-php2shell.py
Resolve any apt update errors before relying on the candidate versions in the report. The checker reads your local APT indexes.
For an additional PHP installation directory:
python3 check-php2shell.py --scan-root /www/server/php
You will see one of three statuses:
| Status | What it means |
|---|---|
FIXED |
Package metadata meets a known patched version threshold. |
UPDATE |
A recognizable Debian package version is below its fixed threshold. |
UNKNOWN |
The checker cannot automatically confirm remediation. |
Here is an illustrative result:
[UPDATE] php8.2-fpm installed=8.2.34-1~deb12u1
Debian package version below 8.2.35-1~deb12u1
UNKNOWN is a deliberate part of the design.
A vendor may backport a security fix without adopting the latest upstream version number. Declaring every older third-party build vulnerable would be misleading. Declaring it fixed without evidence would be worse.
For those cases, the checker asks you to verify the vendor's advisory. Its rules are embedded in the script, dated October 22, 2026; they are not automatically refreshed.
There is another boundary worth understanding: updated packages do not prove that running PHP workers have been restarted. After applying updates, restart the affected PHP-FPM services, Apache when using mod_php, and relevant long-running PHP workers. Then verify your sites.
Containers, chroots, arbitrary custom builds, and application code require separate checks. A FIXED result describes the assessed package metadata; it does not certify the entire server or rule out an earlier compromise.
We tested the checker in Debian 12 and Debian 13 containers, including comparisons using real dpkg, and ran it against installed PHP packages. GitHub Actions also passed for both distributions. The project includes eight automated tests and is available under the MIT license.
If you maintain Debian PHP servers, inspect the script and run it against your installations. Check every PHP runtime that serves traffic, apply the relevant updates, and restart the affected workers.
Contributions are welcome—especially regression tests and additional version rules backed by primary vendor advisories. Please redact sensitive paths and server details when opening issues.
Top comments (0)