PHP Patch Night: exposure check and stopgap configs for the CVSS 10 PHP flaws

The php2shell scanning and stopgap space is crowded. The leak came out on 20 October, and within a day there were several free open-source checkers, an Apache mitigation kit, a Censys query, and write-ups from Patchstack, Sansec, Aikido and PatchMon. A free read-only CLI that records PHP version and setting status already exists, so the patchnight CLI on its own adds little and is hard to charge for. Three gaps remain. First, none of the tools I found take action across a fleet. They are deliberately read-only. None writes session.upload_progress.enabled=Off and reloads PHP-FPM, and none handles panel-managed runtimes like /opt/cpanel/ea-php* and /opt/plesk/php/*, where most agency and small-host PHP actually runs. Second, mapping each install to a correct patched status is still open. Distro and panel backports make version strings unreliable, which versionscan already admits. As of today I found no cPanel, CloudLinux, Plesk, Forge or RunCloud announcements of fixed builds. That makes an alert that tells you when the fixed build for your branch and packaging channel has shipped a real, if short-lived, need. Third, I found no WordPress plugin that reports PHP and ini status for php2shell on shared hosting. However, Patchstack already has the agency dashboard and site connector and could add this quickly. The main risk is timing. The official patch shipped on 21 October, so demand will peak and fade within weeks. The ongoing business would have to be a general PHP runtime patch and EOL monitor for agencies, which competes with PatchMon, Patchstack and the existing hosting panels. EOL branches (8.1 and older) with no official fix are the most durable niche for paid stopgap management.

• ovtechnology/php2shell-check

  Free open-source inventory tool for php2shell (CVE-2026-109618/109619). It is read-only, uses only the Python standard library, writes JSON and CSV, and does not change targets. It covers most of the patchnight CLI except the ini write and FPM reload.

• 0xrsydn/php2shell-scan

  Open-source reachability and change detector that gives verdicts like mitigated, exposed and unchanged. It is pitched as agent-ready and read-only by default.

• syhunt/php2shell-protection

  Open-source emergency Apache mitigation and testing toolkit. It blocks multipart POST requests before they reach PHP, which is a stopgap that does not depend on the ini setting.

• darkfibr/php2shell-detect and Blue-B/php2shell-guard

  More defensive detection and guard projects that appeared within a day of the leak. They show how fast free tooling is filling the space.

• Censys php2shell query (silascutler gist)

  Free internet-wide exposure query for finding PHP installs that may be affected. It overlaps with the 'find exposed installs' part of the idea.

• Patchstack

  WordPress security vendor whose customer base is agencies and hosts. It published the alert, the stopgap guidance and advice to contact hosts. It already has agency dashboards and site connectors, so it could add a PHP version and ini check to its existing plugin.

• PatchMon

  Fleet patch-monitoring product that is marketing php2shell patching across fleets. It competes directly with the multi-server dashboard angle.

• Sansec

  E-commerce security vendor with php2shell research. It notes that PHP 8.1 and older will get no official fix, which is the same EOL-stopgap message this idea relies on.

• Aikido Security

  Developer security platform that covers php2shell. It can flag vulnerable PHP runtimes through its existing scanning product.

• psecio/versionscan

  Older open-source PHP version-to-CVE checker. It only reads the raw version string and does not account for distro backports.

Checked 2026-10-21