PHP < 8.2.35 / 8.3.x < 8.3.36 / 8.4.x < 8.4.27 / 8.5.x < 8.5.12 Multiple Vulnerabilities

#!/usr/bin/env bash
# check_php2shell.sh — Detect PHP vulnerable to CVE-2026-109618 / CVE-2026-109619 (php2shell)
# Outputs: VULNERABLE / PATCHED / UNKNOWN per PHP binary found
# Exit codes: 0 = all patched, 1 = at least one vulnerable, 2 = unknown/no PHP found

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[0;33m'; NC='\033[0m'
FOUND_VULN=0
FOUND_PHP=0

version_ge() {
  # Returns 0 if $1 >= $2 using sort -V
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

check_php() {
  local php_bin="$1"
  if [[ ! -x "$php_bin" ]]; then return; fi
  FOUND_PHP=1
  local full_version
  full_version=$( "$php_bin" -r 'echo PHP_VERSION;' 2>/dev/null ) || { echo -e "${YELLOW}[UNKNOWN]${NC} $php_bin — could not determine version"; return; }
  local major_minor
  major_minor=$( echo "$full_version" | grep -oP '^\d+\.\d+' )

  local fixed=""
  case "$major_minor" in
    8.5) fixed="8.5.12" ;;
    8.4) fixed="8.4.27" ;;
    8.3) fixed="8.3.36" ;;
    8.2) fixed="8.2.35" ;;
    8.1|8.0|7.*|5.*) fixed="" ;; # EOL — no upstream fix
    *) echo -e "${YELLOW}[UNKNOWN]${NC} $php_bin — unrecognized branch $major_minor ($full_version)"; return ;;
  esac

  if [[ -z "$fixed" ]]; then
    echo -e "${RED}[VULNERABLE]${NC} $php_bin — $full_version (EOL branch, no upstream fix available)"
    FOUND_VULN=1
    return
  fi

  if version_ge "$full_version" "$fixed"; then
    echo -e "${GREEN}[PATCHED]${NC} $php_bin — $full_version (>= $fixed)"
  else
    echo -e "${RED}[VULNERABLE]${NC} $php_bin — $full_version (needs >= $fixed)"
    FOUND_VULN=1
  fi
}

# Check session.upload_progress.enabled
check_sup() {
  local php_bin="$1"
  local sup
  sup=$( "$php_bin" -r 'echo ini_get("session.upload_progress.enabled") ? "On" : "Off";' 2>/dev/null ) || return
  if [[ "$sup" == "On" ]]; then
    echo -e "  ${YELLOW}↳ session.upload_progress.enabled = On (attack surface active)${NC}"
  else
    echo -e "  ${GREEN}↳ session.upload_progress.enabled = Off (mitigated)${NC}"
  fi
}

echo "=== php2shell (CVE-2026-109618 / CVE-2026-109619) Check ==="
echo ""

# Collect PHP binaries from PATH and common locations
mapfile -t PHP_BINS < <( { which -a php php8.2 php8.3 php8.4 php8.5 php-fpm php-fpm8.2 php-fpm8.3 php-fpm8.4 php-fpm8.5 2>/dev/null; find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin /opt -maxdepth 3 -name 'php*' -type f -executable 2>/dev/null; } | sort -u )

for bin in "${PHP_BINS[@]}"; do
  check_php "$bin"
  check_sup "$bin"
done

if [[ $FOUND_PHP -eq 0 ]]; then
  echo -e "${YELLOW}[UNKNOWN]${NC} No PHP binaries found on this host."
  exit 2
fi

echo ""
if [[ $FOUND_VULN -eq 1 ]]; then
  echo -e "${RED}RESULT: VULNERABLE — patch immediately.${NC}"
  exit 1
else
  echo -e "${GREEN}RESULT: PATCHED — all detected PHP binaries are at fixed versions.${NC}"
  exit 0
fi