assetnote / php2shell-scanner

# php2shell-scanner
A command-line tool for detecting CVE-2026-109618 and CVE-2026-109619 in PHP applications.
## How It Works
The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1 MiB to 20 MiB, matching the detection logic used by Assetnote's internal scanner.
A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempty HTTP 500 responses without the PHP fatal-error signature are not treated as crash signals.
The scanner tests `/index.php` by default. A path supplied in the URL is preserved, and `--path` or `--path-file` can test custom paths. phpMyAdmin targets are automatically retested at `/show_config_errors.php`. Redirects are not followed.
### SAPI Modes
The default `--sapi auto` mode applies both mod_php and PHP-FPM verdict rules, matching the combined behavior of Assetnote's postmodules. Use `--sapi mod_php` or `--sapi fpm` to restrict detection to a known SAPI.
### Network Impact
Each tested path may receive a 42-byte control request and three probes totalling about 29 MiB. Probing stops as soon as the verdict is settled, and duplicate input URLs are scanned once.
## Requirements
- Python 3.9+
- h11
- tqdm
## Installation
 [code] 
## Usage
Scan a single host:
 [code] 
Scan a list of hosts:
 [code] 
Scan with multiple threads and save results:
 [code] 
Scan with custom headers:
 [code] 
Scan a custom path:
 [code] 
Use only PHP-FPM verdict rules:
 [code] 
## Options
 [code] 
## Credits
The first, original discovery of php2shell is attributed to the Calif team. You can read their write up here: https://calif.io/php2shell/.
The scanner was built by the Assetnote Security Research Team using logic built for Searchlight's Exposure Platform.
## Output
Results are printed to the terminal. When using `-o`, vulnerable hosts are saved to a JSON file with the verdict reason and redacted HTTP request/response evidence.
## Limitations
On specific PHP configurations, the scanner may report a false positive when its multipart probe exceeds PHP's `memory_limit`. Patched and vulnerable versions can then return the same empty HTTP 500 response.
This was reproduced on patched PHP 8.4.27 with `memory_limit` values from **2M to 32M**, and on PHP 8.3.36 at **128M** when `max_multipart_body_parts` is set to **2785 or higher**. The exact threshold may vary between builds.
When PHP does not disclose its version, the scanner cannot distinguish this safe post-patch OOM from the vulnerable pre-patch behavior. Results should therefore be verified against the installed PHP version and any vendor backports