Low Severity
CVE-2026-109619
Published: Oct 25, 2026
Defensive exposure and IOC scanner for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). No exploit traffic.
# php2shell-scan
> Defensive exposure and compromise-indicator scanner for **PHP2Shell** (CVE-2026-109618 / CVE-2026-109619).
>
> 面向 PHP2Shell 漏洞的防御性自查工具：检查 PHP 版本、危险配置、日志 IOC 与可疑 PHP 文件，**不发送任何利用流量**。
PHP2Shell is a pair of critical PHP runtime vulnerabilities disclosed on 21 October 2026. Both can lead to unauthenticated remote code execution. This tool helps operators answer three questions quickly:
1. Which PHP runtimes are installed, and are they fixed?
2. Are the risky `session.upload_progress` / OOM-related settings still in place?
3. Do logs or web roots show signs of exploitation?
It is not an exploit, a vulnerability scanner, or a replacement for EDR/WAF.
---
## Requirements
- Python 3.8+
- No third-party dependencies
- Works on Linux, Windows, and macOS
## Quick start
```bash
git clone https://github.com/wemio/php2shell-scan.git
cd php2shell-scan
python php2shell_scan.py --local
```
Or download `php2shell_scan.py` and run it directly.
## Usage
```bash
# Check local PHP binaries, SAPI, php.ini, FPM pools, Apache mod_php
python php2shell_scan.py --local
# Check an HTTP endpoint (normal GET only)
python php2shell_scan.py --remote https://example.com
# Scan logs for request/host indicators occurred since 2026-10-17
python php2shell_scan.py --logs /var/log/nginx /var/log/php8.3-fpm.log \
--since 2026-10-17
# Scan a web root for recently modified PHP files and webshell heuristics
python php2shell_scan.py --webroot /var/www --since 2026-10-17
# Combine modes and write a JSON report
python php2shell_scan.py --local --remote https://example.com \
--logs /var/log/nginx --webroot /var/www --json report.json
```
### Options
| Option | Description |
|---|---|
| `--local` | Inspect local PHP binaries and server configuration |
| `--remote URL [URL ...]` | Inspect HTTP responses; sends a normal GET only |
| `--logs PATH [PATH ...]` | Scan log files/directories for IOCs |
| `--webroot PATH [PATH ...]` | Scan a web root for suspicious/recent PHP file