Enki Whitehat releases free scanner for PHP2Shell flaws
The tool checks PHP version and configuration without running attack code, and the company has published a root-cause analysis of both CVEs.
Enki Whitehat has released a free diagnostic scanner that checks whether systems are exposed to the PHP2Shell PHP core remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, the company announced. The scanner is available by entering a target URL on its web page, with no login required.
The tool identifies the PHP version and related configuration to make a first-pass risk determination without using actual attack code, according to Enki Whitehat. It is offered free to companies that do not use OFFen ASM, the company's attack surface management product.
Alongside the scanner, Enki Whitehat published an analysis report on the two flaws. The report covers the root causes — incomplete state retention on memory exhaustion for CVE-2026-109618, and a use-after-free caused by reuse of previous request state for CVE-2026-109619 — as well as affected systems and versions, mitigations and official patch guidance.
The company said it plans follow-up publications on identifying and managing externally exposed assets, and on methods for responding quickly to new vulnerabilities.
Enki Whitehat's CEO said that for high-impact vulnerabilities like PHP2Shell, securing the so-called golden time to identify and address exposed assets before attackers matters.
Quick answers
What is the Enki Whitehat scanner for PHP2Shell?
It is a free diagnostic tool that checks whether a system is exposed to CVE-2026-109618 and CVE-2026-109619 by identifying the PHP version and related configuration, without using actual attack code.
How do I use the PHP2Shell scanner?
You enter a target URL on the scanner's web page, and no login is required. Companies that do not use OFFen ASM can use it free of charge.
What does the Enki Whitehat analysis report cover?
It covers the root causes of both CVEs, affected systems and versions, mitigations and official patch guidance.