JoasASantos / php2shell-scanner

# php2shell-scanner
Non-destructive scanner (with opt-in probe) for **CVE-2026-109618** (RCE via
OOM corruption) and **CVE-2026-109619** (RCE via stale global state) — core
PHP bugs fixed in `8.2.35 / 8.3.36 / 8.4.27 / 8.5.12`.
> ✅ **Verified against the official php-src advisories (2026-10-21, Critical).**
> The CVE IDs and the fixed-version table below match upstream exactly.
>
> - CVE-2026-109618 — GHSA-w8hw-w9fx-j79w
> - CVE-2026-109619 — GHSA-6wmf-4rv5-p3rp
### Affected / fixed versions
| Branch | Affected | Fixed |
|--------|----------|-------|
| 8.2 | =8.2"` constraint only narrows branch).
### Origin / WAF bypass (`--origin-scan`)
CDNs hide the origin, so a header read only shows the edge. `--origin-scan`:
1. resolves apex, `www`, non-proxied prefixes (`origin.*`, `cpanel.*`, `mail.*`…)
 and recon subdomains;
2. drops IPs in **Cloudflare / Imperva / Sucuri** edge ranges (IPv4 + IPv6);
3. requests each remaining **origin IP directly** with the real `Host` + SNI,
 reading `Server` / `X-Powered-By` / error pages straight from the origin.
A direct request to an already-exposed IP. Authorized targets only.
Credentialed intel adds IPs DNS never exposes, plus a PHP version from the
indexed banner (flagged intel — may be stale):
- `--shodan-key` / env `SHODAN_API_KEY` — hosts by `hostname: `.
- `--censys-id` + `--censys-secret` / env `CENSYS_API_ID` + `CENSYS_API_SECRET`
 — hosts by TLS-cert / DNS name.
- Any credential auto-enables `--origin-scan`.
 [code] 
### Confidence grade
| Confidence | Meaning |
|-----------|---------|
| `HIGH` | version from exposed phpinfo() or a PHP error page |
| `MEDIUM` | version from an HTTP banner (`expose_php=On`) |
| `LOW` | inference only, or behind a proxy, or a distro backport may apply |
The consolidated output groups targets by severity, sorts VULNERABLE by
confidence (HIGH first), and flags LOW/MEDIUM results to re-check before
reporting.
## Detection logic
Version comparison per branch against the `FIXED` table:
- ` = fixed` → **PATCHED**
- `< 8.2` (EOL) → **VULNERABLE_EOL** (no upstream patch; check distro/OSV backport)
- branch above advisory range or no version → **UNKNOWN** / **SUSPECTED**
## Authorization
Run only against assets you own or are **explicitly permitted** to test. The
`--probe` mode can disrupt fragile workers. You are responsible for your use.
## License
MIT