php2shell upgrade verification in Shannon

[nelliekeygraph]

In light of the php2shell vulnerability, Shannon now ships an experimental flag, --exp-php2shell, that verifies whether a PHP server is still reachable by the php2shell crash vector over the network. It sends a single crafted request to the target URL and reports one of three verdicts: detected, not detected, or inconclusive.

php2shell (CVE-2026-109618 and CVE-2026-109619) is an unauthenticated remote code execution chain in the PHP interpreter itself, so any unpatched PHP server that accepts HTTP requests is affected. The fix is to upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. The flag is for confirming that the upgrade actually landed on every reachable server, not a substitute for upgrading.

The probe reproduces only the first step of the chain (a brief worker crash from memory exhaustion) and never sends the follow-up request required for code execution.

npx @keygraph/shannon start --exp-php2shell -u https://staging.example.com/login

One reachable endpoint is enough to test, because the flaw is in the PHP interpreter rather than in a specific route. The probe crashes one PHP worker on the target, so run it against staging or local development unless the target is explicitly authorized for testing.

The probe was validated against a matrix of local PHP deployments, including the PHP CLI server, PHP-FPM behind nginx, and Apache mod_php, across patched and unpatched 8.3 and 8.4 releases and an end-of-life 8.1 branch, alongside non-PHP controls and a third-party deliberately vulnerable CTF application. There were no false positives on the patched or non-PHP targets, and a separate crash-only pass confirmed that detection does not rely on the version header. The full test matrix is here: https://github.com/KeygraphHQ/shannon/blob/main/docs/exp-php2shell-testing.md

Full usage, verdict meanings, and safety notes are in the documentation: https://github.com/KeygraphHQ/shannon/blob/main/docs/exp-php2shell.md

This flag is experimental. It is provided as-is, may change or be removed without notice, and will not receive long-term maintenance or support.

The escalating probe-size strategy and multi-signal classification approach were informed by the design of Assetnote's php2shell scanner (MIT) (https://github.com/assetnote/php2shell-scanner).