PHP2Shell Scanner

First release

Features

• Scans for the PHP2Shell remote code execution vulnerability (CVE-2026-109618/109619)
• Bulk-registers scan targets by pasting multiple URLs, and fetches each root page to detect whether the target responds and whether it uses http or https
• Full scan (unscanned and vulnerable assets only), rescan of selected targets, re-probe, and scan stop
• Records the verdict and the exposed PHP version, and keeps the scan result history
• Shows a verdict pie chart, a PHP version treemap, and the counts of total, vulnerable, patched, and unscanned assets
• Exports scan targets and scan results as CSV
• All users can view; only administrators can add, scan, and delete targets
• Korean, English, and Japanese UI

Query commands

• php2shell-scan: Scans a single URL on the spot
• php2shell-scan-batch: Scans the URL in each input row on the spot
• php2shell-targets: Lists the registered scan targets
• php2shell-results: Lists the scan result history
• php2shell-add-target-batch: Registers the URL in each input row as a scan target
• php2shell-delete-target-batch: Deletes the scan target matching the URL in each input row