PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure

Summary: PortSwigger released detection for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) within hours of disclosure, starting with passive checks through a Java-based custom scan check, a DAST-compatible BCheck, and an update to James Kettle's ActiveScan++ extension, then adding active checks after testing them across a range of servers and PHP versions. The checks will be natively integrated into Burp Scanner in the next Burp Suite Professional release, and active detection is already built into Burp Suite DAST for users on Burp Scanner version 2026.10.54778 or above.
Why it matters: PortSwigger notes that up to 70% of websites run at least some PHP, and that the main detection method circulating at the time of disclosure involved crashing the server - so the first safe way to check exposure arrived only after the bug was public.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-109618 CVE-2026-109619
Related: Siemens Building Automation and Energy Products Cyber Risks · Nov 12, 2026
Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) Cyber Risks · Oct 29, 2026