Assetnote Releases php2shell-scanner: High-Fidelity Scanner for CVE-2026-109618 & CVE-2026-109619
Summary
Why it matters
- Published
- Collected
📦 Full-Text Content Snapshot
R2 Archive · Full Article PreservedBy Assetnote Security Research Team · Published: October 22, 2026 · Source: github.com/assetnote/php2shell-scanner
php2shell-scanner
A command-line tool for detecting CVE-2026-109618 and CVE-2026-109619 in PHP applications.
How It Works
The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1 MiB to 20 MiB, matching the detection logic used by Assetnote's internal scanner.
A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempty HTTP 500 responses without the PHP fatal-error signature are not treated as crash signals.
The scanner tests /index.php by default. A path supplied in the URL is preserved, and --path or --path-file can test custom paths. phpMyAdmin targets are automatically retested at /show_config_errors.php. Redirects are not followed unless --follow-redirects is set.
SAPI Modes
The default --sapi auto mode applies both mod_php and PHP-FPM verdict rules, matching the combined behavior of Assetnote's postmodules. Use --sapi mod_php or --sapi fpm to restrict detection to a known SAPI.
Network Impact
Each tested path may receive a 42-byte control request and three probes totalling about 29 MiB. Probing stops as soon as the verdict is settled, and duplicate input URLs are scanned once.
Requirements
- Python 3.9+
h11tqdm
Installation
pip install -r requirements.txtDocker
Build the image:
docker build -t php2shell-scanner .Run it with the same options as scanner.py:
docker run --rm php2shell-scanner -u https://example.comMount the current directory to read host lists and write results:
docker run --rm -v "$PWD:/data" -w /data php2shell-scanner -l hosts.txt -o results.jsonUsage
Scan a single host:
python3 scanner.py -u https://example.comScan a list of hosts:
python3 scanner.py -l hosts.txtScan with multiple threads and save results:
python3 scanner.py -l hosts.txt -t 20 -o results.jsonScan with custom headers:
python3 scanner.py -u https://example.com -H "Authorization: Bearer token" -H "Cookie: session=abc"Scan a custom path:
python3 scanner.py -u https://example.com --path /phpinfo.php
python3 scanner.py -u https://example.com --path /index.php --path /admin.php
python3 scanner.py -u https://example.com --path-file paths.txtUse only PHP-FPM verdict rules:
python3 scanner.py -u https://example.com --sapi fpmOptions
-u, --url Single URL to check
-l, --list File containing hosts (one per line)
-t, --threads Number of concurrent threads (default: 10)
--timeout Request timeout in seconds (default: 60)
-o, --output Output file for results (JSON)
--all-results Save all results, not just vulnerable hosts
-k, --insecure Disable TLS certificate verification
--follow-redirects Follow HTTP redirects (up to 10 hops)
-H, --header Custom header (can be used multiple times)
-v, --verbose Show verdict reasons and response snippets
-q, --quiet Only output vulnerable hosts
--no-color Disable colored output
--sapi Verdict rules: auto, mod_php, or fpm (default: auto)
--path Custom path to test (can be used multiple times)
--path-file File containing paths to test (one per line)Credits
The first, original discovery of php2shell is attributed to the Calif team. You can read their write up here: https://calif.io/php2shell/.
The scanner was built by the Assetnote Security Research Team using logic built for Searchlight's Exposure Platform.
Output
Results are printed to the terminal. When using -o, vulnerable hosts are saved to a JSON file with the verdict reason and redacted HTTP request/response evidence.
Limitations
On specific PHP configurations, the scanner may report a false positive when its multipart probe exceeds PHP's memory_limit. Patched and vulnerable versions can then return the same empty HTTP 500 response.
This was reproduced on patched PHP 8.4.27 with memory_limit values from 2M to 32M, and on PHP 8.3.36 at 128M when max_multipart_body_parts is set to 2785 or higher. The exact threshold may vary between builds.
When PHP does not disclose its version, the scanner cannot distinguish this safe post-patch OOM from the vulnerable pre-patch behavior. Results should therefore be verified against the installed PHP version and any vendor backports.
📦 Full-Text Markdown Snapshot archived by Phying News · Original source: github.com
--- id: 10294 title: "Assetnote Releases php2shell-scanner: High-Fidelity Scanner for CVE-2026-109618 & CVE-2026-109619" cve: "CVE-2026-109618, CVE-2026-109619" cvss: 9.2 severity: critical vendor: PHP product: php2shell-scanner affected_versions: "PHP < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12" source_domain: github.com source_url: "https://github.com/assetnote/php2shell-scanner" published_at: "2026-10-22T03:53:20Z" snapshot_at: "2026-10-26T03:07:00Z" archived_by: "Phying News (https://phying.com/item/10294)" lang: en --- # Assetnote Releases php2shell-scanner: High-Fidelity Scanner for CVE-2026-109618 & CVE-2026-109619 *By Assetnote Security Research Team · Published: October 22, 2026 · Source: [github.com/assetnote/php2shell-scanner](https://github.com/assetnote/php2shell-scanner)* # php2shell-scanner A command-line tool for detecting **CVE-2026-109618** and **CVE-2026-109619** in PHP applications. ## How It Works The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1 MiB to 20 MiB, matching the detection logic used by Assetnote's internal scanner. A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempty HTTP 500 responses without the PHP fatal-error signature are not treated as crash signals. The scanner tests `/index.php` by default. A path supplied in the URL is preserved, and `--path` or `--path-file` can test custom paths. phpMyAdmin targets are automatically retested at `/show_config_errors.php`. Redirects are not followed unless `--follow-redirects` is set. ### SAPI Modes The default `--sapi auto` mode applies both `mod_php` and `PHP-FPM` verdict rules, matching the combined behavior of Assetnote's postmodules. Use `--sapi mod_php` or `--sapi fpm` to restrict detection to a known SAPI. ### Network Impact Each tested path may receive a 42-byte control request and three probes totalling about 29 MiB. Probing stops as soon as the verdict is settled, and duplicate input URLs are scanned once. ## Requirements - Python 3.9+ - `h11` - `tqdm` ## Installation ```bash pip install -r requirements.txt ``` ### Docker Build the image: ```bash docker build -t php2shell-scanner . ``` Run it with the same options as `scanner.py`: ```bash docker run --rm php2shell-scanner -u https://example.com ``` Mount the current directory to read host lists and write results: ```bash docker run --rm -v "$PWD:/data" -w /data php2shell-scanner -l hosts.txt -o results.json ``` ## Usage Scan a single host: ```bash python3 scanner.py -u https://example.com ``` Scan a list of hosts: ```bash python3 scanner.py -l hosts.txt ``` Scan with multiple threads and save results: ```bash python3 scanner.py -l hosts.txt -t 20 -o results.json ``` Scan with custom headers: ```bash python3 scanner.py -u https://example.com -H "Authorization: Bearer token" -H "Cookie: session=abc" ``` Scan a custom path: ```bash python3 scanner.py -u https://example.com --path /phpinfo.php python3 scanner.py -u https://example.com --path /index.php --path /admin.php python3 scanner.py -u https://example.com --path-file paths.txt ``` Use only PHP-FPM verdict rules: ```bash python3 scanner.py -u https://example.com --sapi fpm ``` ## Options ```text -u, --url Single URL to check -l, --list File containing hosts (one per line) -t, --threads Number of concurrent threads (default: 10) --timeout Request timeout in seconds (default: 60) -o, --output Output file for results (JSON) --all-results Save all results, not just vulnerable hosts -k, --insecure Disable TLS certificate verification --follow-redirects Follow HTTP redirects (up to 10 hops) -H, --header Custom header (can be used multiple times) -v, --verbose Show verdict reasons and response snippets -q, --quiet Only output vulnerable hosts --no-color Disable colored output --sapi Verdict rules: auto, mod_php, or fpm (default: auto) --path Custom path to test (can be used multiple times) --path-file File containing paths to test (one per line) ``` ## Credits The first, original discovery of php2shell is attributed to the Calif team. You can read their write up here: [https://calif.io/php2shell/](https://calif.io/php2shell/). The scanner was built by the Assetnote Security Research Team using logic built for [Searchlight's Exposure Platform](https://www.slcyber.io/exposure). ## Output Results are printed to the terminal. When using `-o`, vulnerable hosts are saved to a JSON file with the verdict reason and redacted HTTP request/response evidence. ## Limitations On specific PHP configurations, the scanner may report a false positive when its multipart probe exceeds PHP's `memory_limit`. Patched and vulnerable versions can then return the same empty HTTP 500 response. This was reproduced on patched PHP 8.4.27 with `memory_limit` values from **2M to 32M**, and on PHP 8.3.36 at **128M** when `max_multipart_body_parts` is set to **2785 or higher**. The exact threshold may vary between builds. When PHP does not disclose its version, the scanner cannot distinguish this safe post-patch OOM from the vulnerable pre-patch behavior. Results should therefore be verified against the installed PHP version and any vendor backports. --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10294) · Original source: [github.com](https://github.com/assetnote/php2shell-scanner)