aancw / php2shell-scanner

# php2shell-scanner
Detects exposure to the PHP core RCEs **CVE-2026-109618** and **CVE-2026-109619**
("PHP2Shell", published 2026-10-21) in three modes:
| mode | what it does |
|------|--------------|
| `url` | blackbox scan of a web target over HTTP, no shell access needed |
| `local` | host checks on the machine the scanner runs on |
| `ssh` | the same host checks on a remote host over SSH |
The scanner is a detector, not an exploit. The only request it sends is a benign
`session.upload_progress` arming probe that contains no PHP code unless you ask
for the inert canary with `--canary`.
## Install
Download the binary for your platform from the
releases page:
| platform | asset |
|----------|-------|
| linux x86_64 | `php2shell-scanner-linux-amd64.tar.gz` |
| linux arm64 | `php2shell-scanner-linux-arm64.tar.gz` |
| linux armv6 | `php2shell-scanner-linux-arm.tar.gz` |
| macOS intel | `php2shell-scanner-darwin-amd64.tar.gz` |
| macOS apple silicon | `php2shell-scanner-darwin-arm64.tar.gz` |
| windows x86_64 | `php2shell-scanner-windows-amd64.exe` |
 [code] 
The binaries are statically linked, so there is nothing to install besides the
file itself.
## Usage
 [code] 
### Scanning many hosts
`url` and `ssh` take repeatable targets. They are scanned in parallel
(`--concurrency`, default 5) and the results come back per target.
 [code] 
A host can be `host`, `host:port` or `user@host:port`. The port from `-H` wins
over `-p`. `local` stays single target, it is the machine the scanner runs on.
A target that cannot be reached does not stop the run: it gets a
`SCAN_FAILED` or `SSH_CONNECT_FAILED` finding and the other targets are still
scanned.
### Password authentication for SSH
 [code] 
The same credentials are used for every host in the run. Keys, the agent
(`--agent`) and the password can be combined; the server decides what it
accepts.
Useful flags:
| flag | modes | meaning |
|------|-------|---------|
| `--json` | all | print the report as JSON |
| `--fail-on ` | all | exit 1 at this severity or worse (default `high`, `none` disables) |
| `--webroot ` | local, ssh | extra document root to scan; the document roots of the web server configuration are detected automatically |
| `--probe` / `--canary` | url | arming probe on by default; `--canary` adds an inert PHP comment so Suricata/YARA rules fire |
| `--crawl` | url | look for exposed phpinfo pages (on by default) |
| `--insecure` | url | skip TLS verification |
| `--path` | url | extra endpoint to probe, repeatable |
| `--agent`, `--password`, `--passphrase`, `--known-hosts`, `--insecure-host-key` | ssh | authentication and host key handling |
Exit codes: `0` clean, `1` findings at or above `--fail-on`, `2` usage or runtime error.
## What is checked
### Version (all modes)
| branch | fixed in | last vulnerable |
|--------|----------|-----------------|
| 8.5 | 8.5.12 | 8.5.11 |
| 8.4 | 8.4.27 | 8.4.26 |
| 8.3 | 8.3.36 | 8.3.35 |
| 8.2 | 8.2.35 | 8.2.34 |
| ≤ 8.1 | EOL, no routine updates (7.4/8.0/8.