I Built an Emergency Toolkit for PHP2Shell RCE (CVE-2026-109618) - From Pakistan

说明与用途

构建了一个紧急工具包，用于在共享主机环境中检测并缓解 PHP2Shell RCE 漏洞（CVE-2026-109618），允许无 root 权限的用户通过 .htaccess 或 php.ini 进行补丁。

问题

A critical PHP vulnerability (PHP2Shell, CVE-2026-109618) allows remote code execution via malicious EXIF headers, leaving many shared hosting servers in Pakistan unpatched.

结果

The toolkit successfully scans for PHP2Shell vulnerabilities and applies an immediate mitigation patch, protecting shared hosting servers from RCE without requiring root access.

工作流

• Clone the toolkit repository: git clone https://github.com/farimazhar/php2shell-fix-toolkit
• Navigate into the directory: cd php2shell-fix-toolkit
• Run the scanner against the web root: ./scan.sh /var/www/html
• Apply the mitigation: ./fix.sh --apply

证据

When I saw a new critical PHP vulnerability PHP2Shell (CVE-2026-109618) with CVSS 10.0 allowing RCE via EXIF headers, I knew many shared hosting servers in Pakistan would remain unpatched.

来源

Non-destructive scanner for php2shell

来源

Instant mitigation (.htaccess / http://php.ini patch)

来源

Works on cPanel / Shared Hosting with no root needed

来源