Videos
Where's my PHP? Surveyor OT Pro finds the PHP2Shell binaries
PHP2Shell is two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. Both allow unauthenticated remote code execution on PHP that serves web requests, and attackers exploited them from October 17, 2026, before they were disclosed. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Distributions often patch PHP without changing its version number, so Surveyor OT Pro matches the exact binaries by their hashes. It opens three VM disk images on an air-gapped machine, records every file in them, and finds the vulnerable php-fpm, php and php-cgi binaries. It reads the built images as they are and needs no source code.
https://wheresmyphp.spicelabs.io
Chapters
- 0:00 PHP2Shell
- 0:16 The fixed releases
- 0:35 Three web server disks
- 0:49 Search for the hashes
- 1:08 Where's my PHP?
Transcript
0:00 PHP2Shell PHP2Shell is two critical flaws in PHP. They let anyone, with no login, run code on a server where PHP handles web requests, and attackers used them before they were disclosed. So where is the vulnerable PHP in what we run?
0:16 The fixed releases The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distributions often patch PHP and keep its version number, so a version string can mislead. Surveyor matches the exact binary by its hash.
0:35 Three web server disks Here are the disk images of three web servers. Surveyor OT Pro reads them as they are, with no source code and no network. It opens each disk and records every file on it, with its hashes.
0:49 Search for the hashes Search those records for the hashes of the vulnerable PHP builds, and two of the three disks match. The storefront already runs the fixed release. And here are the binaries. The web portal has a vulnerable php-fpm and PHP command line, and the intranet has a vulnerable php-cgi.
1:08 Where's my PHP? When the next flaw lands, you can know in minutes where it is. Find out more at wheresmyphp.spicelabs.io.