[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftvthjzcbr9vp":3},{"code":4,"message":5,"data":6,"timestamp":32},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":22,"summary_md":23,"topic":24,"github_topics":27,"license":28,"homepage":29,"updated_at":30,"history":31},"assetnote\u002Fphp2shell-scanner",9,"High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)","Python",735,119,256,3,[16],{"id":17,"title":18,"points":19,"comments":20,"posted_at":21},50206417,"Php2shell Scanner",2,0,"2026-10-23","A CLI scanner that tells you whether a PHP host is exposed to the php2shell crash bugs, for pentesters and incident responders.","## The problem\n\nIf you run or audit PHP hosts, you need a fast answer to one question: is this box still carrying the php2shell flaws (CVE-2026-109618 and CVE-2026-109619)? Checking by hand means crafting oversized multipart bodies and interpreting ambiguous 500s. This tool automates that whole probe-and-verdict loop for single URLs or long host lists.\n\n## What's different\n\nMost CVE scanners check a version banner and call it a day. This one reproduces the actual exploitation path: a small control request, then up to three multipart probes with deeply nested PHP array keys, stepping from 1 MiB to 20 MiB. The verdict comes from runtime behaviour, memory-exhaustion errors, differential empty 500s, or PHP-FPM worker failures, and it deliberately filters out ordinary 5xx and nonempty errors that would otherwise cause noise. It also encodes the maintainers' separate mod_php and PHP-FPM verdict logic and can be restricted to either SAPI, which a generic Nuclei template would not do. phpMyAdmin targets are automatically retested at `\u002Fshow_config_errors.php`. It is the detection half of a single, narrowly scoped vulnerability, not a general web scanner.\n\n## Who it's for\n\nPentesters and red teams who need to triage a client's PHP estate, and sysadmins or incident responders confirming exposure before patching. Anyone with a large inventory of PHP hosts will like the list mode, threading, and JSON output. Look elsewhere if you want broad vulnerability coverage, authenticated application testing, or stealthy probing: each path can receive roughly 29 MiB of traffic and can crash workers, so this is not for production monitoring or shared hosting you do not own.\n\n## Cost of adoption\n\nPython 3.9+ with `h11` and `tqdm`, plus a Dockerfile if you prefer containers. The README's install line is `pip install -r requirements.txt`. The license is MIT. Failure modes matter: the README admits false positives when the probe exceeds PHP's `memory_limit`, reproduced on patched PHP 8.4.27 at 2M–32M, and on 8.3.36 at 128M with a high `max_multipart_body_parts`. When the target hides its PHP version, the scanner cannot separate a safe post-patch OOM from vulnerable behaviour, so findings need confirmation against the installed version and vendor backports. Probing can also take down FPM workers, so get authorization first.\n\n## Verdict\n\nThis is a brand-new project, created 2026-10-22 and tracked for only two days, so there is no long-term track record to lean on. The momentum is real but very early: about 248 stars per day and a #9 spot on the new Python board, while the only Hacker News thread drew 2 points. That pattern fits a timely response to a freshly disclosed CVE rather than an established tool. The detection logic is specific and thoughtful, but the documented false-positive case means results should be treated as leads, not proof. Worth running during an authorized assessment of PHP hosts; wait for independent validation before trusting it as a compliance gate.",{"slug":25,"name":26},"security","Security & Privacy",[],"MIT",null,"2026-10-24T23:37:02Z",[],1792901568]