PHP2Shell Scanner and Free Checkers

Free PHP2Shell checkers answer one of three narrow questions: what your server announces, how it behaves under a test request, or what a vendor's platform found. An unauthenticated external scan can't reliably establish the exact installed PHP package or its backport status. Tools with authenticated or agent access to the host can inspect package details and patch status, which is why the check that settles it runs on the server. The complete PHP2Shell guide covers both flaws in full. This page covers the tools, which of them can hurt a live server, and where the real check happens.

The three kinds of tool

Passive version checkers

Astra's free checker takes a public URL, reads the X-Powered-By and Server response headers, and compares any PHP version it finds with the fixed releases.⁠⁴ Reported Astra lists its own limits: a hidden version does not mean the system is safe, and the command-line PHP can differ from the version PHP-FPM or Apache uses. Its results table sends backported builds to the vendor's advisory and changelog.⁠⁴

The version read uses public headers. The checker's optional probes are a separate step. Astra warns that its out-of-memory probe may stress PHP workers, especially in low-memory environments, and advises against running disruptive checks on production unless you have approved the risk.⁠⁴

Active probe scanners

Assetnote's open-source scanner (MIT license) is a command-line tool that documents its detection method and judges a target by how it behaves.⁠⁵ Reported Per its README, it sends a 42-byte control request, then up to three multipart probes totalling about 29 MiB per tested path, and stops once it has a verdict. It reports a target as vulnerable on a PHP memory-exhaustion error, an empty HTTP 500 that differs from the control response, a PHP-FPM worker failure, or an advertised version known to be unpatched.⁠⁵

The README also lists false positives. Patched PHP 8.4.27 returned the same empty 500 with memory_limit between 2M and 32M, and patched 8.3.36 did at 128M when max_multipart_body_parts was 2785 or higher. When PHP hides its version, the scanner can't tell that safe post-patch failure from the vulnerable one.⁠⁵

A probe built to make a server fail can make your production worker fail. Run one against a staging copy or in a maintenance window, within the scope the system's owner approved, and tell your host first. We give no run commands here.

Vulnerability-management platforms

Reported Qualys announced a free PHP2Shell service on 26 October: 15 days, up to 1,000 assets, counted from activation.⁠²⁠⁶ Qualys says it scans internet-facing assets from its cloud without agents and checks exploitability with harmless validation payloads. ITWire's copy of the press release names VMDR, ETM and TruRisk Eliminate as the products involved.⁠²⁠⁶ Qualys's own example narrowed one environment's 1,539 PHP assets to 25 confirmed.⁠²

That is one vendor-picked case. The offer suits a team with many servers, containers and bundled PHP. For one small site it is a form to fill in. This is a description, not a recommendation.

Before you run anything

Scan only systems you own or have written authorization to test, and stay inside the approved scope. Authorization doesn't make a test safe. Even an approved active probe can crash workers and cause an outage, so agree the target paths, the time window and the stop condition with the system's owner before it runs.

• Prefer passive checks on production. Keep active probes for staging or a maintenance window, with your host informed.
• Verify where a tool came from. Read any script before you run it, prefer a publisher you can identify and code you can read, and confirm the repository owner yourself, because "PHP2Shell" in a name is not provenance. Don't paste secrets into a web checker.
• Walk away from unverified downloads, unknown publishers, requests for credentials or site access the tool doesn't need, and tools whose behavior you can't evaluate. Legitimate security tools can require installation, so check the publisher and read what the tool does first.

Nothing says incident response like running an unread script from a stranger's repository on the box that holds your database password. This is general supply-chain hygiene, not a claim about any specific tool.

What a scanner can't tell you

A scanner reports on the present. It can't say whether someone got in before you patched. Astra says patching stops further exploitation of the fixed flaw but doesn't show whether an attacker had access earlier.⁠⁴ What to do if the scan was too late covers the signs and first moves, and what exploitation looks like in logs shows where to look.

CVE-2026-115560 is a separate flaw. PHP disclosed it on 23 October, the 21 October releases do not fix it, and PHP suggests session.upload_progress.enabled=0 until the next regular bugfix release.⁠¹ The Assetnote README names only the two PHP2Shell CVEs, and the fixed releases Astra's checker measures against do not fix it.⁠⁴⁠⁵

Opinion A CDN or WAF in front of the site can rewrite headers or answer a request before it reaches PHP, so a result may describe the edge and not your runtime.

How you'd notice

The sign you're misreading a scan is a mismatch. The version a header advertises, the version php -v prints and the version the web server runs are three separate facts. php -v reports the command-line build. PHP-FPM and Apache load their own, and Astra says they can differ.⁠⁴ Read the version from the binary or module serving requests, then match the package build to your vendor's advisory or changelog, since a backport can keep the old number.⁠² The server-side steps are in the guide to checking the version on the server itself.

Do this

Do today

1. Read the PHP version from the binary or module that serves web requests on every server and container, using the server-side version check, and match the package build to your vendor's advisory or changelog.
2. Install the fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or a vendor build with the backport, then restart every PHP worker. The patch steps cover PHP-FPM and Apache on Linux.
3. Treat any online checker result as a hint, and confirm it on the server.
4. Ask your host in writing for the package build and patch status if you have no server access.

Do this week

5. Add PHP versions, including containers and bundled PHP, to your asset inventory.
6. Schedule a recurring server-side version check.
7. Hide X-Powered-By if you want, as minor hardening only. It blinds passive checkers and fixes nothing.
8. Run an active probe only against staging, within the approved testing scope and with your host informed, if you want a behavioural test.

Can wait

9. Hold off on buying a commercial scanner for a single small site.
10. Postpone comparing scanner feature lists until the server-side checks are done.