php2shell: Is your PHP server open to takeover?

01Check your PHP version

The quickest test. Run it on the web server, not your laptop:

Copyphp -v

The command-line PHP can be a different build from the one serving your site. Check the web-facing binary too:

Copy# PHP-FPM (nginx, most modern hosts)
for b in /usr/sbin/php-fpm* $(command -v php-fpm); do "$b" -v | head -1; done

# Apache mod_php: which PHP module is loaded
apachectl -M 2>/dev/null | grep -i php

No shell access? Ask your host, or look in cPanel → MultiPHP Manager, Plesk → PHP Settings, or WordPress → Tools → Site Health → Info → Server.

02Using Debian, Ubuntu, RHEL or Alma packages? Check the changelog

Distributions often backport the fix without changing the version number. A version like 8.1.2-1ubuntu2.x can be patched. Confirm it in the package changelog:

Copy# Debian / Ubuntu
apt changelog "php$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')-common" 2>/dev/null | grep -E "CVE-2026-10961[89]"

# RHEL / Alma / Rocky / CentOS Stream
rpm -q --changelog php-common | grep -E "CVE-2026-10961[89]"

If both CVE IDs appear, your package is patched. If nothing prints, treat the server as vulnerable.

03Check your exposure settings

These settings decide which attack paths are reachable before you patch:

Copyphp -i | grep -E "^(memory_limit|post_max_size|upload_max_filesize|session.upload_progress.enabled|fatal_error_backtraces) "

The output below is the default, and it is exposed: memory_limit => 128M with session.upload_progress.enabled => On. The web SAPI can use a different php.ini from the CLI. For a true picture, open a temporary phpinfo() page and delete it straight after.

01Shells spawned by PHP

Copyps -eo pid,ppid,user,cmd --forest | grep -A3 -E "php-fpm|apache2|httpd" | grep -E "sh -c|bash|python|perl|curl|wget|nc "

Watch for php-fpm, apache2 or httpd starting sh, bash, curl, wget or nc, and for reverse-shell patterns like /dev/tcp/, mkfifo or fsockopen.

02New or changed files in the web root

Copyfind /var/www -type f -newermt "2026-10-20" \( -name "*.php" -o -name "*.phtml" -o -name ".htaccess" \) -ls

03Persistence

Copycrontab -l -u www-data; ls -la /etc/cron.* /var/spool/cron* 2>/dev/null
grep -E "/bin/(ba)?sh" /etc/passwd; last -n 20

04Odd large multipart POSTs

In your access logs, look for bursts of large multipart/form-data POSTs to ordinary pages, each followed by 500 errors or PHP "Allowed memory size exhausted" fatals in the error log.

Copygrep -h "Allowed memory size" /var/log/php*fpm*.log /var/log/apache2/error.log /var/log/nginx/error.log 2>/dev/null | tail -50