User Guide
PHP2Shell Scanner keeps a register of your PHP web assets and checks them for the PHP2Shell remote code execution vulnerability (CVE-2026-109618/109619). PHP2Shell is a flaw in the PHP engine itself, not in a particular application, so any web server that runs PHP can be affected whatever the application on top.
When you register a target URL, the app fetches its root page to decide whether it responds and whether it speaks http or https. Running a scan then records, per target, whether it is vulnerable and which PHP version it exposes, and the top of the Scan Targets screen shows the verdict statistics and the PHP version distribution. After patching, you rescan only the assets that were vulnerable to confirm the fix.
Prerequisites
Two things must be in place before you start. The details are in the Install Guide.
- Network - the Logpresso server must be able to connect to the targets' web ports
- Administrator permission - adding targets, scanning, re-probing and deleting are done by a cluster or company administrator
and run it outside business hours against production services.
Basic flow
The basic flow is register targets → probe → scan all → review results → patch → rescan.
Scan all checks only the responding assets that have not been scanned yet or are currently vulnerable. Running it again after patching therefore rechecks just the assets that were vulnerable, without sending needless traffic to assets already confirmed safe.
Menus
| Menu | Description | Guide |
|---|---|---|
| Scan Targets | Register targets, run scans, and see the verdict statistics and PHP version distribution | Scan Targets |
| Scan Results | Browse the result history recorded by every scan and export it as CSV | Scan Results |
| Vulnerability | How the flaw works, affected versions, detection, remediation and IDS rules | In the app |
| Scanner Guide | How the scanner checks a target and reaches a verdict | In the app |
Contents
| Page | Covers |
|---|---|
| Scan Targets | Registering targets, probing, scanning, rescanning, deleting, and reading the statistics |
| Scan Results | Browsing the result history and what each verdict means |
| Query Commands | Listing, registering and deleting targets, and scanning on the spot, from a query |
If you are new, start with Scan Targets.