Exploit for Improperly Controlled Sequential Memory Allocation in Php

[![Go Version](

[![CVE](

[![License](

[![Non-Destructive](

[![Authorized Use Only](

php2shell-scanner is a Go-based PHP2shell scanner, built for security researchers and penetration testers conducting **authorized assessments**

It validates whether a PHP target is susceptible to the `session.upload_progress` filename injection primitive that underlies CVE-2026-109618 and CVE-2026-109619. It **never executes any code on the target** - confirmation is done by injecting an inert random token (no `` is the step this scanner deliberately omits.

| Feature | CyberRoute Python | This Scanner (Go) |

|------------------------|------------------------|--------------------------------|

| Language | Python + stdlib | Go - single static binary |

| TLS support | No (raw sockets only) | Yes + `--skip-tls` flag |

| Concurrent scanning | No | Yes - goroutine worker pool |

| Batch / multi-target | No | Yes - `--targets` file |

| Output formats | Terminal only | terminal / json / markdown |

| Report to file | No | `--output report.json` |

| Custom headers | No | `--header "Name: Value"` |

| Custom User-Agent | No | `--user-agent` |

| Verbose debug mode | No | `--verbose` |

| Unit tests | No | Version classifier tested |

| Runtime dependencies | Python 3 | None |

Download the binary from [Releases]( then:

git clone

go build -ldflags="-s -w" -o php2shell-scanner ./cmd/scanner/

go install github.com/alham-rizvi/php2shell-scanner/cmd/scanner@latest

--target Single target, e.g.

--targets File of URLs (one per line; # = )

--session-path Endpoint calling session_start() (default: /)

--lfi LFI endpoint with FUZZ marker

Enables probe 4 (canary inject+include proof)

--save-path session.save_path on the target

--timeout Per-request timeout (default: 10s)

--skip-tls Skip TLS certificate verification

--user-agent Custom User-Agent string

--header Extra header(s): "Name: Value"

--format terminal | json | markdown (default: terminal)

--output Write report to file instead of stdout

--no-color Disable ANSI color output

--verbose Print raw probe debug data

--concurrency Parallel scans when using --targets (default: 5)

--yes Acknowledge you are authorized to test this target

--version Print version and exit

# Preconditions check only (version + fixation + upload_progress)

./php2shell-scanner --target --yes

# Full end-to-end confirmation with an LFI endpoint

--lfi ' \

# Batch scan - multiple targets, 10 concurrent workers

# Markdown report for a bug report or issue tracker

--lfi ' \

# HTTPS target with self-signed cert, custom auth header

| Verdict | Meaning |

|--------------------------|-------------------------------------------------------------------------|

| `VULNERABLE (confirmed)` | Canary injected and read back - inject+include primitive proven |

| `LIKELY VULNERABLE` | Affected version + fixation + upload_progress; supply --lfi to confirm |

| `PRECONDITIONS PRESENT` | Some signals hold; version unclear or one check failed |

| `LIKELY PATCHED` | PHP version at or above the fixed release for its branch |

| `NOT DETECTED` | No preconditions observed |

| Code | Meaning |

|------|--------------------------------------|

| 0 | Vulnerable or confirmed vulnerable |

| 1 | Patched / not detected |

| 2 | Unreachable / usage error |

Exit codes are consistent across single and batch modes (worst-case across all targets).

| Branch | Vulnerable below | First patched |

|--------|-----------------|---------------|

| 8.2 | 8.2.35 | 8.2.35 |

| 8.3 | 8.3.36 | 8.3.36 |

| 8.4 | 8.4.27 | 8.4.27 |

| 8.5 | 8.5.12 | 8.5.12 |

Branches 8.1, 8.0, 7.x, and 5.x are end-of-life with no official patch. They are treated as vulnerable wherever `upload_progress` is present.

And patch PHP to the fixed release for your branch.

| `- main.go CLI entry point, flag parsing, batch orchestration

| | `- checker.go Four probes, HTTP client, verdict logic

| | |- version.go PHP version classifier, banner extraction

| `- report.go Terminal / JSON / Markdown output formatters

Alham Rizvi ([@alham-rizvi](

- CVE-2026-109618 - PHP session.upload_progress filename injection

- CVE-2026-109619 - PHP session fixation via POST body

[ikow/php2shell-poc]( - the exploit POC this scanner detects (referenced for testing against the lab environment only).

For authorized security testing and educational use only.

Do not scan systems you do not own or lack explicit written permission to test.

The authors accept no liability for misuse.