assetnote/php2shell-scanner

The problem

If you run or audit PHP hosts, you need a fast answer to one question: is this box still carrying the php2shell flaws (CVE-2026-109618 and CVE-2026-109619)? Checking by hand means crafting oversized multipart bodies and interpreting ambiguous 500s. This tool automates that whole probe-and-verdict loop for single URLs or long host lists.

What's different

Most CVE scanners check a version banner and call it a day. This one reproduces the actual exploitation path: a small control request, then up to three multipart probes with deeply nested PHP array keys, stepping from 1 MiB to 20 MiB. The verdict comes from runtime behaviour, memory-exhaustion errors, differential empty 500s, or PHP-FPM worker failures, and it deliberately filters out ordinary 5xx and nonempty errors that would otherwise cause noise. It also encodes the maintainers' separate mod_php and PHP-FPM verdict logic and can be restricted to either SAPI, which a generic Nuclei template would not do. phpMyAdmin targets are automatically retested at /show_config_errors.php. It is the detection half of a single, narrowly scoped vulnerability, not a general web scanner.

Who it's for

Pentesters and red teams who need to triage a client's PHP estate, and sysadmins or incident responders confirming exposure before patching. Anyone with a large inventory of PHP hosts will like the list mode, threading, and JSON output. Look elsewhere if you want broad vulnerability coverage, authenticated application testing, or stealthy probing: each path can receive roughly 29 MiB of traffic and can crash workers, so this is not for production monitoring or shared hosting you do not own.

Cost of adoption

Python 3.9+ with h11 and tqdm, plus a Dockerfile if you prefer containers. The README's install line is pip install -r requirements.txt. The license is MIT. Failure modes matter: the README admits false positives when the probe exceeds PHP's memory_limit, reproduced on patched PHP 8.4.27 at 2M–32M, and on 8.3.36 at 128M with a high max_multipart_body_parts. When the target hides its PHP version, the scanner cannot separate a safe post-patch OOM from vulnerable behaviour, so findings need confirmation against the installed version and vendor backports. Probing can also take down FPM workers, so get authorization first.

Verdict

This is a brand-new project, created 2026-10-22 and tracked for only two days, so there is no long-term track record to lean on. The momentum is real but very early: about 248 stars per day and a #9 spot on the new Python board, while the only Hacker News thread drew 2 points. That pattern fits a timely response to a freshly disclosed CVE rather than an established tool. The detection logic is specific and thoughtful, but the documented false-positive case means results should be treated as leads, not proof. Worth running during an authorized assessment of PHP hosts; wait for independent validation before trusting it as a compliance gate.