0xrsydn/php2shell-scan is a Python command-line tool for examining the reachability of the php2shell PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, and the changes before and after patching. According to the repository description, it targets vulnerabilities in the PHP upload progress handling path, and its default behavior is read-only; it uses only the standard library with no extra dependencies. The provided FACTS list no public release version, so this is covered as a repository introduction rather than a version change.
The tool sends anonymous requests, checks the PHP traces in the web server responses and the way the worker terminates, and compares the stored baseline result with the following check. Results are classified as exposed, mitigated, improved, changed, or uncertain, and it also offers sequential checks across multiple hosts along with limits on request count and size. Because it compares the baseline result with later checks to watch for state changes, a single response check and a before-and-after patch comparison can be told apart. It is an MIT-licensed Python tool, designed so that it can be hooked straight into an agent.
What these results tell you, though, is only whether the vulnerable path is reachable on the server and whether the state has changed since the baseline. The documentation explicitly states the boundary that a blocked response alone does not determine whether a patch has been applied. So a block cannot be used as evidence that patching is complete, and the output of this scanner has to be read as a signal about the state of the server.