Searchlight Cyber releases php2shell-scanner for PHP2Shell CVE detection

Searchlight Cyber has open-sourced php2shell-scanner, a tool that checks hosts for CVE-2026-109618 and CVE-2026-109619, the PHP RCE bugs patched on October 21. Rather than relying on version banners, the scanner deliberately triggers PHP memory exhaustion to confirm exploitability and is free on GitHub.

• Scanner targets CVE-2026-109618 and CVE-2026-109619, patched on October 21
• Flaws allow pre-auth RCE on Apache mod_php and PHP-FPM under default configs
• Tool triggers PHP OOM errors, falling back to version checks only as a last resort
• Each tested path gets a 42-byte control request and three probes totaling ~29 MiB