php2shell-scan

Overview ¶

Command php2shell-scan finds PHP runtimes vulnerable to CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell", fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12) in filesystems, container images and the image references in source code. It is the engine with only the php2shell detector, under the name people search for, with php2shell-scan's flags and exit status rules.