Why this matters right now
PHP2Shell (CVE-2026-109618 / 109619)
Two critical flaws in PHP core itself — not a framework or CMS — allow a remote attacker to run code on the server with no credentials and no user interaction, rated 9.8 (CVSS v3.1). Because the bugs are in the runtime, every application the server hosts is exposed. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; branches 7.4, 8.0 and 8.1 receive only source backports, and everything older gets no official fix. Exploitation attempts were observed in the wild even before the patch shipped.
The eMudhra / emSign certificate failure (CVE-2026-111943)
Eight intermediate CA certificates from eMudhra (emSign brand) were generated with private keys that were tiny whole numbers — one was literally the number 4 — making them recoverable by anyone in under a second. Browsers moved to distrust the affected roots and eMudhra announced its exit from the TLS certificate business. Indian government services and several banks have historically relied on emSign certificates, so the question "what is my certificate chain actually anchored to?" is no longer academic.
What the tool does
Point it at a single host, an IP range, a domain, or a file of targets. For every host it finds a live web service on, it determines PHP exposure to PHP2Shell and inspects the TLS certificate chain for recoverable (weak) keys — then prints a clear verdict, the evidence behind it, and the remediation for each finding. It is built to sweep an entire estate and surface the hosts that need attention first, without disturbing any of them.
Features
Both transports, by default
Scans HTTP (port 80) and HTTPS (port 443) automatically, so a host reachable only over TLS is never missed.
Self-contained
Give it 192.168.0.* and it probes both ports and the common PHP entry paths with no extra flags. Non-standard ports can be specified when needed.
Any target shape
Single IP, CIDR-style range, fully-qualified domain, or a file of targets — one per line.
Subdomain discovery
Given a domain, it enumerates subdomains (Certificate Transparency plus DNS) and scans each discovered host.
Concurrent sweeps
A full subnet is scanned in parallel and completes quickly.
Actionable output
Every finding carries its evidence, a confidence grade, the fixed PHP release for that branch, and concise remediation guidance.
Certificate weak-key detection
Walks the full certificate chain each host presents, flags any recoverable (small-scalar) EC key — the eMudhra/emSign class of defect — and prints the chain annotated with the issuing organisation, so an "emSign" anchor is shown for what it is: eMudhra.
Runs where you need it
A native Windows command-line binary with no dependencies, built to run on current and older Windows versions alike.
How it detects — non-intrusive by design
This is the deliberate difference. The tool establishes exposure by reading what a host already tells you — never by driving it toward the memory fault the vulnerability exploits. It does not send the crafted multipart requests that trigger the out-of-memory condition, so it cannot crash, corrupt, or destabilise a production worker, and there is no risk of it becoming the first half of an attack. That makes it safe to run across live customer and government infrastructure.
Because it reads rather than probes, it is also honest about the limits of remote detection:
- It confirms a vulnerable version with high confidence — especially on end-of-life branches that have no fix anywhere.
- It never reports a host as "safe" on remote evidence alone. A clean result is labelled "no vulnerable version observed — not conclusive," because Linux distributions backport fixes without changing the version string, and a proxy can rewrite a banner. Over-claiming safety is how a free tool gets a customer breached; this one refuses to do it.
- It grades every finding HIGH / MEDIUM / LOW and states the reason, so you know exactly how much to trust each line.
- It sees through hidden versions where it safely can — detecting an exposed phpinfo() page and reading its build date, the one remote signal that resolves the distribution-backport ambiguity.
- It is honest about CDNs. A host behind Cloudflare, Akamai or similar is reported as fronted — the banner reflects the edge, not your origin — rather than being silently shown as clean.
Quick start
Full usage is printed by running the tool with no arguments.
Download the free eScan PHP2Shell & Certificate-Weakness Scanner for Windows.
Download Free Scanner1a833b54f8124b3e447b2924e90ab2e0b8eacec592bf39c501d1ae71551066d5