• PHP2Shell (CVE-2026-109618 / CVE-2026-109619): memory-corruption bugs in PHP core itself, affecting every PHP application running on an unpatched 8.2 to 8.5.
• CVE-2026-110447: OS command injection in Nextcloud’s built-in Collabora CODE app, actively used to drop PHP web shells.

While helping a client check whether their exposed server had been hit, we built two small, dependency-free tools to triage for both. We’re releasing them so other teams can do the same.

• php_rce_logscan.py reads Apache access and error logs (plain, gz, bz2, xz) and flags exploit attempts, dropped web shells, worker crashes and anomalous POST activity.
• php2shell_server_sweep.sh is a read-only host sweep: PHP version, web shells, suspicious processes, persistence and Nextcloud app integrity. It reports and suggests; it never deletes, kills or changes anything.

One honest caveat. PHP2Shell delivers its payload in the POST body, which Apache does not log. Our tools reliably catch the noisy exploit footprint, the Collabora web-shell campaign and post-exploitation traces, but a quiet, crash-free exploit can leave no trace in the logs. A clean log result is not an all-clear. Always confirm on the host, patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and restart your web workers.

Both scripts, usage and the full indicator list are on our repository: GitHub