Security assessment

PHP2Shell Scanner

Check advertised PHP versions for CVE-2026-109618 and CVE-2026-109619, and review the evidence behind each rating.

Scan targets

Enter the URLs you want to check. The scanner checks headers and, when no version is disclosed, inspects a small GET response for PHP indicators.

One complete URL per line. Up to 10 targets per submission; 10 target scans per IP per 60 seconds.

CONFIRMED VULNERABLE means an affected PHP version was identified under the rating policy. Header checks do not prove exploitability or rule out vendor backports. Redirects are reported without following them.

Ready to scan

Submit an authorized target to see its PHP indicators, version, rating, and supporting evidence.