[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":67,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":74,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":80,"vulnerability-29870":87},[4,29,36,44,53,59],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":27,"variant":28,"campaign_id":6},"PHP2Shell detection - top pages, pricing CTA","php2shell-rce","🚨 Detect PHP2Shell with any paid plan. Get proof now","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams","See pricing options","secondary",{"title":30,"slug":31,"text":32,"link":8,"external":9,"targets":33,"cta":35,"variant":28,"campaign_id":6},"PHP2Shell detection - NetScan on the NS page","php2shell-rce-netscan","🚨 Detect PHP2Shell with NetScan (from $96\u002Fmo for 16 assets)",[34],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick NetScan",{"title":37,"slug":38,"text":39,"link":40,"external":41,"targets":42,"cta":40,"variant":28,"campaign_id":6},"PHP2Shell & Node2Shell detection - pricing page","php2shell-rce-pricing","PHP2Shell & Node2Shell detection live in every paid plan (unlimited rescans for patch validation)",null,false,[43],"\u002Fpricing",{"title":45,"slug":46,"text":47,"link":48,"external":9,"targets":49,"cta":52,"variant":28,"campaign_id":46},"Office Hours #14","office-hours-14","[Live Office Hours, Wed Oct 28] Check, patch, prove: PHP2Shell and other critical CVEs","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_xbwerEx9QFSjfNWIHcjtHw",[50,51],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":54,"slug":55,"text":56,"link":8,"external":9,"targets":57,"cta":27,"variant":28,"campaign_id":6},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan",[58],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan",{"title":60,"slug":61,"text":62,"link":8,"external":9,"targets":63,"cta":27,"variant":28,"campaign_id":61},"Node2Shell detection - Vuln DB homepage, product, CVE page","node2shell","🚨 Detect Node2Shell with any paid plan. Get proof now",[64,65,66],"\u002Fvulnerabilities-exploits","\u002Fproduct","\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",["Island",68],{"key":69,"params":70,"result":72},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":71},"{}",{"head":73},{},["Island",75],{"key":76,"params":77,"result":78},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":71},{"head":79},{},["Island",81],{"key":82,"params":83,"result":85},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":84},"{\"text-color\":\"gray\"}",{"head":86},{},{"id":88,"detectable_with":89,"vuln_details":96,"vuln_id":115,"name":116,"published":114,"updated":40},29870,{"tool":90,"engine":93},{"id":91,"name":92},1,"Network Scanner",{"id":94,"name":95},2,"Nuclei",{"id":88,"codename":97,"description":40,"severity":98,"risk_description":99,"public_description":100,"public_recommendation":101,"recommendation":40,"references":102,"cvssv3":110,"epss_score":111,"epss_percentile":111,"cve":112,"in_cisa_catalog":41,"date":114,"software_type":40,"vendor":40,"product":40,"ptt_exploit_capabilities":40},"PHP2Shell","critical","A match means the server handled the oversized multipart body the way vulnerable PHP builds do. It does not prove that code execution is possible on this host. Keep in mind that the scan itself is not free: the 8 MB and 20 MB probes can use a lot of memory and may kill the PHP worker that receives them.","PHP versions prior to 8.2.35, 8.3.36, 8.4.27 and 8.5.12 contain an uncontrolled memory consumption vulnerability caused by the parsing of a multipart\u002Fform-data request body that contains many part headers and deeply nested array field names. An unauthenticated attacker can send a crafted multipart request that exhausts the configured memory limit, aborting request processing and leading to denial of service. Official fixed releases exist only for the 8.2, 8.3, 8.4 and 8.5 branches. PHP 8.1, 8.0 and 7.4 are end-of-life and get no new releases, but the PHP security team published minimal source backports for them, and some Linux distributions and LTS vendors ship backported packages. PHP 7.3 and earlier have no official fix. Detection sends a small multipart request to \u002Findex.php as a baseline, then retries with bodies of roughly 1 MB, 8 MB and 20 MB, stopping at the first hit, and matches when PHP returns an \"Allowed memory size exhausted\" error or when the baseline served a page but the large request comes back empty or as a 502-504 gateway error.","Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. These fix both CVE-2026-109618 and CVE-2026-109619. On PHP 8.1, 8.0 or 7.4, install a backported package from your distribution or LTS vendor, or build from the PHP security team's source backport branches (PHP-7.4\u002F8.0\u002F8.1-CVE-2026-109618-109619 in php-src). PHP 7.3 and older have no fix and must be upgraded to a supported release. While you're in php.ini, set expose_php = Off so the server stops advertising its PHP version in response headers.",[103,104,105,106,107,108,109],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-109618","https:\u002F\u002Fwww.php.net\u002FChangeLog-8.php","https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-w8hw-w9fx-j79w","https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp","https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Ftree\u002FPHP-7.4-CVE-2026-109618-109619","https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Ftree\u002FPHP-8.0-CVE-2026-109618-109619","https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Ftree\u002FPHP-8.1-CVE-2026-109618-109619",9.2,0.99981,[113],"CVE-2026-109618","2026-10-21T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-109618","PHP2Shell - Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)"]