https://oni.sqzer.com/php2shell-scanner/atom.xmlCheck PHP2Shell (CVE-2026-109618, CVE-2026-109619) from inside your server: distribution backports, missed restarts and interim mitigations, verdicts computed in the browser.2026-11-12T03:54:04Zurn:git:1f00712aec0582667996c6809eae4eb1cae868422026-11-12T03:54:04Z2026-11-12T03:54:04Zgithub-actions[bot]41898282+github-actions[bot]@users.noreply.github.comdata: update distro advisories urn:git:7085fcfad15ee6bc5a9d7e1390565599530531bd2026-11-12T12:53:30+09:002026-11-12T12:53:30+09:00debuman110329244+debuman@users.noreply.github.comUpdate site source links for debuman urn:git:6625c61c118916bc5b2268e85bba85a590e60e092026-11-11T06:34:41Z2026-11-11T06:34:41Zgithub-actions[bot]41898282+github-actions[bot]@users.noreply.github.comdata: update distro advisories urn:git:655ec129570c49983d484710af79188713193a252026-11-05T20:01:11Z2026-11-05T20:01:11Zgithub-actions[bot]41898282+github-actions[bot]@users.noreply.github.comdata: update distro advisories urn:git:a3c8a914e1f21a5fbae789a6c1e31efa7fbf1f2c2026-10-26T09:54:15+09:002026-10-26T09:54:15+09:00Hyukjin An110329244+sqzer-x@users.noreply.github.comdocs: shorten the README to overview, differences, checks and usage The README had grown into a full reference (verdict rules, data pipeline, self-hosting, development notes). It now covers only what a first-time user needs: an overview, how the tool differs from header-based scanners, what the probe and the server script read, and how to use them, with the safety notes for the probe URL, its 404 and self-deletion, and running the script as root. Every statement was checked against the code. - site: the no-JavaScript notice pointed to the verdict rules in the README; it now points to upstream.json and the distribution advisories. - .gitignore: docs/ holds private working documents and is never committed. urn:git:6bfd931560c642ba484be38a5311f9c5063208662026-10-26T00:19:07Z2026-10-26T00:19:07Zgithub-actions[bot]41898282+github-actions[bot]@users.noreply.github.comdata: update distro advisories urn:git:5b515a3ac50b302b6e9cb6e5f238aac3c52daef82026-10-26T09:18:23+09:002026-10-26T09:18:23+09:00Hyukjin An110329244+sqzer-x@users.noreply.github.comtest: pin verdict tests to a frozen data snapshot The verdict and remediation tests read the live site/data/distro.json, so every scheduled advisory refresh could change an expected verdict. After the data commit of 23 Oct (Debian 14 php8.4 fixed, new Red Hat states for RHEL 6 and 7), five tests failed and every Deploy run stopped at the Test step, which also held back later deploys and data refreshes. - test/fixtures/distro-snapshot.json: the data from before that commit; contract, findings, remediation, retest and round3 tests read it. - test/data.test.mjs: checks only the shape of the live distro.json and that the engine reads every release in it, in both languages. - pages.yml: runs that check again on freshly fetched data before it is deployed or committed. - README: how the snapshot works and when to replace it. urn:git:ef0d1411ba7e651ed2bf537a84ff10721d12700d2026-10-23T17:13:43Z2026-10-23T17:13:43Zgithub-actions[bot]41898282+github-actions[bot]@users.noreply.github.comdata: update distro advisories urn:git:aecbdae6c6fc250cce59773819c20aac922db2d02026-10-23T17:23:45+09:002026-10-23T17:23:45+09:00Hyukjin An110329244+sqzer-x@users.noreply.github.comPoint site links and download commands at php2shell.sqzer.com urn:git:8f9afd28460e39130ebe0c7f2921398f153ce3242026-10-23T17:16:41+09:002026-10-23T17:16:41+09:00Hyukjin An110329244+sqzer-x@users.noreply.github.comInitial release PHP2Shell Scanner checks whether a server's PHP is affected by CVE-2026-109618 and CVE-2026-109619 from facts collected on the server itself, and computes the verdict in the browser. - PHP probe (check/) and read-only server script (scripts/) - Check page in English and Korean (site/) that handles distribution backports, missed restarts and interim mitigations, with step-by-step remediation for the detected setup - Distribution data refreshed every 6 hours and deployed to GitHub Pages