Have you patched yet?
Commit
76e9a69
yeah patched already of course, and also wrote a little script that checks if you are probably affected: https://laracraft.tech/en/blog/php2shell-were-you-hit-a-read-only-triage-script-for-your-server
LaracraftPHP2Shell: you patched, but were you hit? A read-only triage script for your serverPatching PHP2Shell (CVE-2026-109618 and CVE-2026-109619) closes the hole, but it does not tell you whether someone got in before you patched. Here is a read-only bash script that checks your PHP builds and looks for the few traces an exploitation attempt leaves behind.
commit 76e9a69