JoasASantos/php2shell-scanner
CLI tool
Can I trust it?
Be careful with this one.
Warnings Check
Very new: it was created yesterday. Wait a little before installing it.
Stars from real accounts No data
We haven't checked its stars for fakes yet.
Active OK
Last change today.
Licence Careful
No licence: legally you can't reuse the code, unless the README says otherwise.
Quick checks from public data. They help, but they are no guarantee.
What it is
Python scanner that checks targets for PHP core RCE CVE-2026-109618 and CVE-2026-109619 without exploiting them. It enumerates subdomains via crt.sh and subfinder, grabs HTTP banners, and infers vulnerability from PHP version. An opt-in load probe can cause DoS.
Who it's for
Security engineers and sysadmins auditing PHP servers they are authorized to test
How to use it
Install
git clone https://github.com/JoasASantos/php2shell-scanner.gitFrom its README. Check it there before running it.
Ask your AI to set it up
Paste this into Claude, ChatGPT or your coding assistant.
Help me install and set up JoasASantos/php2shell-scanner in my project. Follow its README: https://github.com/JoasASantos/php2shell-scanner. Explain each step and check it is safe before running anything.
Star curve
Get alerts for repos like this
We'll email you when repos like this start rising. Free, once a week, only what matches.
18,966 GitHub repos watched and ranked every hour. Figures as of 22 October 2026.
What arrives: one email on Mondays with the repos that match, never more. See last week's. Privacy
For maintainers
Add this badge to your README. It shows the repo's place on the radar, updates every hour and links back to this page.
[](https://repoalerts.com/repo/JoasASantos/php2shell-scanner?ref=badge)Similar repos
- eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Proof-of-concept exploit for two PHP core vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution in vulnerable PHP environments. Includes a README with affected version
- openai/php2shell-checker
A checker that tells whether a website's PHP version, read from HTTP response headers, or a local PHP binary, read via php -v, is vulnerable to php2shell. Results are OK, VULNERABLE or UNKNOWN, with a
- syrex1013/php2shell
Proof-of-concept exploit and lab for CVE-2026-109618 and CVE-2026-109619, a heap use-after-free in PHP's session.upload_progress handling. Includes a Docker lab reproducing the stale-pointer write on
- ikow/php2shell-poc
Research toolkit for two PHP pre-auth RCE vulnerabilities (CVE-2026-109618/109619) abusing session.upload_progress. Includes five chain descriptions, three exploit scripts, detection rules for Suricat
- NCSC-NL/php2shell
Operational information on two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, including affected contexts, fixed PHP versions, temporary mitigations and links
- dinosn/php-cve-2026-10961x-lab-poc
Lab reproduction and vulnerability-research package for PHP 8.5.11 CVE-2026-109618 and CVE-2026-109619, a remote code execution chain using memory disclosure via session cookies and a use-after-free.