Install Guide
PHP2Shell Scanner registers your PHP web assets and checks them for the PHP2Shell remote code execution vulnerability (CVE-2026-109618/109619). A scan sends HTTP requests straight from the Logpresso server to the target web server, so the following must be in place along with the app.
- The Logpresso server must be allowed to connect out to the targets' web ports (e.g. 80, 443, 8080).
- Adding targets, scanning, re-probing and deleting are limited to cluster or company administrators.
- A scan sends up to about 29 MiB per target. Use it only against assets you are authorized to test.
Go through the steps in order.
1. Install the app
Install PHP2Shell Scanner from the App Store.
Once installed, Scan Targets, Scan Results, Vulnerability and Scanner Guide appear in the left menu. On first start the app creates the tables that hold targets and scan history, so there is nothing else to prepare.
2. Check the network
Scan requests leave from the Logpresso server. If a firewall or proxy sits between the Logpresso server and the targets, allow the following.
| Direction | Target | Notes |
|---|---|---|
| Logpresso server → targets | Web service ports (80, 443, ...) | Used to fetch the root page when a target is added, and for scan requests |
If a web application firewall (WAF) or reverse proxy fronts a target, its request size limits can turn the verdict into Inconclusive. In that case, exempt the Logpresso server address for the duration of the scan.
3. Check permissions
| Action | Required permission |
|---|---|
| View screens and results, export CSV | Any logged-in user |
| Add targets, scan all, rescan, re-probe, delete | Cluster or company administrator |
Users who are not administrators see the write buttons disabled, with the reason shown on hover.
4. Verify the installation
Scanning one target end to end is the surest check.
- In Scan Targets → Add URLs, enter the URL of a target you are authorized to test and click Add
- When the probe finishes, the status turns to Responding and the scheme (http or https) is filled in
- Click Scan all and wait in the progress dialog until it finishes
- The target's Verdict and PHP version are filled in and the statistics at the top update
- The result appears on the Scan Results screen
Troubleshooting
| Symptom | Cause | Action |
|---|---|---|
| Status is Unreachable | The Logpresso server cannot reach the target port | Check firewall and proxy settings, then select the target and Re-probe |
| Add and scan buttons are disabled | No administrator permission | Run it with an administrator account |
| "Nothing to scan" | No responding target is unscanned or currently vulnerable | To check again, select the targets and use Rescan |
| "a scan is already running" | A scan of the same company is in progress | Run it again after the current scan finishes or is stopped |
| Verdict is Inconclusive | The request was rejected before reaching PHP (400, 403, 413, ...) | Check the WAF or proxy request size limits and blocking policy |
Once installed, see the User Guide for how to scan.