A command-line tool for detecting CVE-2026-109618 and CVE-2026-109619 in PHP applications.
The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1 MiB to 20 MiB, matching the detection logic used by Assetnote's internal scanner.
A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempty HTTP 500 responses without the PHP fatal-error signature are not treated as crash signals.
The scanner tests /index.php by default. A path supplied in the URL is preserved, and --path or --path-file can test custom paths. phpMyAdmin targets are automatically retested at /show_config_errors.php. Redirects are not followed unless --follow-redirects is set.
The default --sapi auto mode applies both mod_php and PHP-FPM verdict rules, matching the combined behavior of Assetnote's postmodules. Use --sapi mod_php or --sapi fpm to restrict detection to a known SAPI.
Each tested path may receive a 42-byte control request and three probes totalling about 29 MiB. Probing stops as soon as the verdict is settled, and duplicate input URLs are scanned once.
- Python 3.9+
- h11
- tqdm
pip install -r requirements.txt
Build the image:
docker build -t php2shell-scanner .
Run it with the same options as scanner.py:
docker run --rm php2shell-scanner -u https://example.com
Mount the current directory to read host lists and write results:
docker run --rm -v "$PWD:/data" -w /data php2shell-scanner -l hosts.txt -o results.json
Scan a single host:
python3 scanner.py -u https://example.com
Scan a list of hosts:
python3 scanner.py -l hosts.txt
Scan with multiple threads and save results:
python3 scanner.py -l hosts.txt -t 20 -o results.json
Scan with custom headers:
python3 scanner.py -u https://example.com -H "Authorization: Bearer token" -H "Cookie: session=abc"
Scan a custom path:
python3 scanner.py -u https://example.com --path /phpinfo.php
python3 scanner.py -u https://example.com --path /index.php --path /admin.php
python3 scanner.py -u https://example.com --path-file paths.txt
Use only PHP-FPM verdict rules:
python3 scanner.py -u https://example.com --sapi fpm
-u, --url Single URL to check
-l, --list File containing hosts (one per line)
-t, --threads Number of concurrent threads (default: 10)
--timeout Request timeout in seconds (default: 60)
-o, --output Output file for results (JSON)
--all-results Save all results, not just vulnerable hosts
-k, --insecure Disable TLS certificate verification
--follow-redirects Follow HTTP redirects (up to 10 hops)
-H, --header Custom header (can be used multiple times)
-v, --verbose Show verdict reasons and response snippets
-q, --quiet Only output vulnerable hosts
--no-color Disable colored output
--sapi Verdict rules: auto, mod_php, or fpm (default: auto)
--path Custom path to test (can be used multiple times)
--path-file File containing paths to test (one per line)
The first, original discovery of php2shell is attributed to the Calif team. You can read their write up here: https://calif.io/php2shell/.
The scanner was built by the Assetnote Security Research Team using logic built for Searchlight's Exposure Platform.
Results are printed to the terminal. When using -o, vulnerable hosts are saved to a JSON file with the verdict reason and redacted HTTP request/response evidence.
On specific PHP configurations, the scanner may report a false positive when its multipart probe exceeds PHP's memory_limit. Patched and vulnerable versions can then return the same empty HTTP 500 response.
This was reproduced on patched PHP 8.4.27 with memory_limit values from 2M to 32M, and on PHP 8.3.36 at 128M when max_multipart_body_parts is set to 2785 or higher. The exact threshold may vary between builds.
When PHP does not disclose its version, the scanner cannot distinguish this safe post-patch OOM from the vulnerable pre-patch behavior. Results should therefore be verified against the installed PHP version and any vendor backports