Find vulnerable PHP before attackers do. A free, read-only scanner for php2shell, the critical flaw that lets attackers run code on PHP web servers with no login.
$ ./php-guardian.sh php-guardian 1.1.0 - php2shell check (CVE-2026-109618 / CVE-2026-109619) PATCHED-DISTRO 8.3.6 /usr/bin/php8.3 -> package php8.3-cli 8.3.6-0ubuntu0.24.04.13 lists the php2shell fix in its changelog UNSUPPORTED 8.1.27 /usr/sbin/php-fpm8.1 -> PHP 8.1 is end-of-life, CISA says take it offline until upgraded PATCHED 8.2.35 /usr/bin/php8.2 -> at or above 8.2.35 Found 3 PHP install(s): 0 vulnerable, 1 unsupported, 1 patched, 1 patched by distro, 0 to review
v1.0 flagged that 8.3.6 as vulnerable by version number, but Ubuntu had already backported the fix. v1.1 reads the package changelog, so it reports this correctly instead of raising a false alarm.
CISA's first instruction for php2shell is to inventory every system running PHP. That's harder than it sounds, because PHP hides inside other software: MAMP, XAMPP, Homebrew, cPanel, and bundled apps. php-guardian does that inventory step in seconds, then tells you exactly what to patch.
PATH plus common hiding spots: Homebrew, MAMP, XAMPP, Herd, phpenv, cPanel, Linux packages.
Compares against the patched releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35.
Ubuntu, Debian, and RHEL backport fixes without bumping the version. php-guardian checks the package changelog for the CVE.
PHP 8.1 and older gets marked UNSUPPORTED, which CISA says to take offline.
--json output and exit codes for pipelines, cron jobs, and log tools.
git clone https://github.com/jeffreyesdavid/php-guardian.git cd php-guardian chmod +x php-guardian.sh ./php-guardian.sh # scan PATH + common locations ./php-guardian.sh --deep # search the whole disk (use sudo) ./php-guardian.sh --json # machine-readable output
macOS and Linux, plain bash, nothing to install. Read-only: it reads version numbers and changes nothing.
| Status | Meaning | Action |
|---|---|---|
| VULNERABLE | Below the patched release | Update now, internet-facing first |
| UNSUPPORTED | PHP 8.1 or older | Take offline until upgraded |
| PATCHED | At or above the fix | You're good |
| REVIEW | Newer than the alert covers | Confirm with the PHP advisory |