Free PHP Compromise Triage Tool

JUMPSEC has released PHPocalypse, a free, open-source triage tool designed to help organisations investigate potential signs of compromise associated with the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Unlike checks that simply establish if a system may be vulnerable, PHPocalypse examines available evidence to help answer the more important question: has exploitation actually taken place?

GET PHPocalypse ON GITHUB

A free tool to help investigate potential PHP compromise

Knowing that your PHP environment is vulnerable and knowing that it has actually been compromised are two very different things.

PHPocalypse was developed by JUMPSEC Labs to help bridge that gap.
Run against a Linux PHP web server, the read-only script checks relevant PHP settings, examines session files and logs for evidence associated with the vulnerabilities, and collects suspicious artefacts for further investigation. The results are packaged into a single ZIP archive that can be reviewed internally, shared with your incident response team, or provided to JUMPSEC for analysis.

PHPocalypse is completely free to use. You do not need to be a JUMPSEC client or engage JUMPSEC to use it.

What does PHPocalypse look for?

PHPocalypse focuses on evidence associated with two of the PHP2Shell exploitation chains identified in the vulnerability research.

It examines PHP session files and available logs for suspicious activity associated with Chains A and C, while also checking relevant PHP configuration and gathering supporting evidence from the host.

The tool can identify:

Suspicious PHP session files
Known log signatures
Relevant PHP configuration
Suspicious files requiring further investigation
Gaps where expected evidence could not be accessed or collected

PHPocalypse does not assess Chain B, which involves a separate unserialize / var_destroy memory-safety issue, and it cannot identify every possible exploitation method. A lack of identified indicators should therefore not be treated as proof that a host is clean.

GET PHPocalypse ON GITHUB

Need help investigating the results?

PHPocalypse is designed for initial compromise triage. Its findings should be considered alongside the other evidence available within your environment and are not a substitute for a full incident investigation.

If you are not confident running the tool yourself, do not have the capacity to investigate the output, or would value an independent expert assessment, JUMPSEC can also provide additional support.

Our team can help you collect the relevant evidence, analyse it for signs of exploitation or compromise, explain what the findings mean and provide clear recommendations on what to do next. Where evidence of compromise is identified, we can support escalation into Incident Response.

Confirmed compromise?

Finding evidence of compromise can quickly shift the priority from investigation to response. Our Incident Response team is available to help you understand what has happened, contain the incident and take the right next steps.

Speak to our IR team