php2shell scanner
Check whether a PHP server is vulnerable to the php2shell engine-level RCE. Crash-based detection, a verdict in seconds. Only scan systems you own or are authorized to test.
Scan a target
Enter a URL you are authorized to test. The scanner sends crafted requests and reads the response. Only scan systems you own or have permission to assess.
A probe triggered the PHP out-of-memory fatal error. Crash-confirmed and banner-independent.
No crash, and the host advertises a fixed PHP release (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later).
No crash and no version advertised. Not a confirmation of safety — verify the running version directly.
Recent scans
Targets are redacted. Only a masked host fragment, country, and verdict are shown.
Frequently asked questions
What is the php2shell scanner?
The php2shell scanner is a free tool from O3 Security that checks whether a PHP server is vulnerable to CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote-code-execution bugs in the PHP engine. It sends crafted multipart probes and reports a crash-based verdict rather than relying on the advertised version.
How does the php2shell scanner detect the vulnerability?
It sends a crafted multipart request designed to trigger the PHP out-of-memory bailout path. If the engine returns the PHP fatal-error memory-exhaustion signature, the host is reported Vulnerable. This crash-based detection works even when the server hides its PHP version.
Is the php2shell scanner safe to run against my server?
Only scan systems you own or are authorized to test. The scanner sends memory-exhaustion probes that can briefly crash a PHP worker, so treat it as an active test, not a passive check. O3 blocks scans of internal, private, and metadata addresses.
Which PHP versions are vulnerable to php2shell?
Every PHP release back to 5.4 is affected. Fixes shipped in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 5.x, 7.x, 8.0 and 8.1 are end-of-life and receive no official fix, so those servers need a branch upgrade.
What does a "No signal" result mean?
No signal means the server did not crash and did not advertise its PHP version, so the scanner cannot confirm the result either way. It is not proof of safety. Verify the running PHP version and patch state directly on the host.
Exposure data: Shodan, collected 2026-10-22. Counts are internet-facing hosts that disclose a PHP version in the X-Powered-By header. Roughly four in five PHP servers hide their version, so these are a floor, not a census. "Unpatchable" = PHP 5.x / 7.x / 8.0 / 8.1, which receive no official php2shell fix. Risk colouring blends absolute unpatchable host count with the unpatchable share, so a host is flagged by exposure, not confirmed exploitable.
This checks one host. O3 checks your whole org.
Continuously detect php2shell and every other critical exposure across your entire fleet, from code to runtime, with reachability-aware prioritization so you fix what actually matters first.