The GitHub repository assetnote/php2shell-scanner is a command-line scanner that detects two php2shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in PHP applications. The repository description introduces it as a high-precision inspection tool. It is written in Python and uses the MIT license. There is no published official release information. The tool sends a control request, then continues with staged multipart requests, and judges signs of vulnerability based on the responses.
This inspection approach focuses on directly confirming vulnerable behavior. The verdict relies on prescribed responses such as PHP memory exhaustion errors or worker failures. Because it sends the requests in order and looks at the response at each stage, it differs from checks that merely look at published version numbers. It also checks the verdict matched to the PHP execution method and looks at published version information at the same time. Therefore, when interpreting the results, you need to consider the behavior and version information of the relevant PHP environment together.
However, it is noted that false positives can occur under some PHP configurations. Even if signs of vulnerability are detected, the installed PHP version and any fixes applied by the vendor need to be checked separately. It is also documented that the test requests may affect the network. So rather than determining safety on its own, this tool is closer to a dedicated inspection means for reviewing results with the target environment in mind.