php2shell-scan
Scans one URL for the PHP2Shell vulnerability (CVE-2026-109618/109619) and returns one row with the verdict. A scan sends up to about 29 MiB to the target, so run it only against assets you are authorized to test. Cancelling the query stops the request in flight at once.
php2shell-scan url=VALUE [sapi=VALUE] [timeout=VALUE] [insecure=VALUE]
- url=VALUE
- Required. URL to scan, for example https://192.0.2.10/. Without a scheme, https:// is assumed.
- sapi=VALUE
- Optional. Which crash signals count: auto (default) applies both mod_php and PHP-FPM rules, mod_php or fpm applies one set.
- timeout=VALUE
- Optional. Per-request read timeout in seconds. Default: 60.
- insecure=VALUE
- Optional. t skips TLS certificate verification, for internal assets with self-signed certificates. Default: f.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| url | String | URL | URL that was scanned, e.g. https://192.0.2.10:8080/ |
| verdict | String | Verdict | e.g. VULNERABLE, FIXED, INCONCLUSIVE, NO_SIGNAL, ERROR |
| is_vulnerable | Boolean | Vulnerable | true when vulnerable, false when not, null when undecided, e.g. true |
| sapi | String | SAPI | e.g. mod_php, PHP-FPM, mod_php/PHP-FPM, unknown |
| powered_by | String | X-Powered-By | X-Powered-By response header, e.g. PHP/8.3.12 |
| php_version | String | PHP version | PHP version parsed from X-Powered-By, e.g. 8.3.12 |
| reason | String | Reason | Why the verdict was reached, e.g. probe 2 (8 MiB, 1020 parts) crashed the request handler |
| probe_count | Integer | Probes sent | Number of crafted probes sent (0-3), e.g. 3 |
| error | String | Error | Present only when the scan could not complete, e.g. control request failed: request timed out |