A command-line tool for detecting CVE-2026-109618 and CVE-2026-109619 in PHP applications.
The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1 MiB to 20 MiB, matching the detection logic used by Assetnote's internal scanner.
A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempty HTTP 500 responses without the PHP fatal-error signature are not treated as crash signals.
The scanner tests /index.php by default. A path supplied in the URL is preserved, and --path or --path-file can test custom paths. phpMyAdmin targets are automatically retested at /show_config_errors.php . Redirects are not followed.
The default --sapi auto mode applies both mod_php and PHP-FPM verdict rules, matching the combined behavior of Assetnote's postmodules. Use --sapi mod_php or --sapi fpm to restrict detection to a known SAPI.
Each tested path may receive a 42-byte control request and three probes totalling 29 MiB. Probing stops as soon as the verdict is settled, and duplicate input URLs are scanned once.
Scan a list of hosts:
Scan with multiple threads and save results:
Scan with custom headers:
Use only PHP-FPM verdict rules:
The first, original discovery of php2shell is attributed to the Calif team. You can read their write up here: .
The scanner was built by the Assetnote Security Research Team using logic built for Searchlight's Exposure Platform .
Results are printed to the terminal. When using -o , vulnerable hosts are saved to a JSON file with the verdict reason and redacted HTTP request/response evidence.
On specific PHP configurations, the scanner may report a false positive when its multipart probe exceeds PHP's memory_limit . Patched and vulnerable versions can then return the same empty HTTP 500 response.
This was reproduced on patched PHP 8.4.27 with memory_limit values from 2M to 32M , and on PHP 8.3.36 at 128M when max_multipart_body_parts is set to 2785 or higher . The exact threshold may vary between builds.
When PHP does not disclose its version, the scanner cannot distinguish this safe post-patch OOM from the vulnerable pre-patch behavior. Results should therefore be verified against the installed PHP version and any vendor backports
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
