Before-Patch Check: did PHP2Shell get in before you patched?

I'd call this space competitive rather than empty. PHP2Shell (CVE-2026-109618/109619) was disclosed on October 21, 2026, two days ago, and I already found about nine open-source scanners on GitHub. Most check exposure or patch status. At least one, php2shell-response-kit, is a free compromise-triage script that overlaps heavily with the CLI idea. Wordfence CLI, Imunify360, CXS and Maldet already cover generic web shell and upload scanning for WordPress sites and cPanel servers. The CLI has a narrow gap. It would have to be WordPress-aware: checking new admin users and wp_options cron entries, running WP-CLI core checksums, scoping file changes to the exploitation window (attempts date back to at least October 17), and producing a one-page verdict per site that an agency can hand to a client. None of the tools I found combine those. But the core will be open source and free, and community scripts appear daily, so it will be hard to charge for. The wp2shell compromise-scanner plugin shows anyone can build this kind of scored, since-disclosure verdict within days. The host sweep pack is the more defensible product. I found nothing that runs PHP2Shell-window checks across every cPanel or Plesk account and ranks accounts by how likely they are to be compromised. Small hosts are the ones paying, and they have hundreds of accounts to triage. The risk is that Imunify360 or a cPanel plugin vendor ships the same feature as a free signature update. There are two more caveats. Vendors such as Huntress and Sophos say no confirmed PHP2Shell-specific indicators of compromise exist yet, so a verdict can only rest on generic post-compromise signs, and a clean result proves little. And demand for this will probably fade within weeks, so a new entrant needs to ship almost immediately. It should also position the product as reusable "since disclosure" triage for the next mass PHP or WordPress vulnerability, not just PHP2Shell.

• php2shell-response-kit (AlexVargasV)

  The closest match to the CLI idea. It is a free, read-only Linux shell script plus a guide and self-assessment form. It finds vulnerable PHP binaries and containers, risky ini settings, worker segfaults and OOM bursts, web log anomalies, web shells, odd files and persistence. It works per host and is not WordPress-aware. It does not check admin users or WP cron, and it does not write a per-site verdict.

• Wordfence CLI

  A free, open-source command-line malware scanner from a major WordPress security vendor. It scans file systems against Wordfence signatures and can be run across many sites. It is generic malware detection with no PHP2Shell window logic, and the results did not show admin-user or cron checks.

• Compromise Scanner for wp2shell (WordPress plugin)

  A GPLv3 plugin that gives a scored verdict for a different exploit chain (wp2shell, CVE-2026-63030 / CVE-2026-60137). It checks database artifacts and records created since disclosure, including account-related checks. It shows the same since-disclosure, scored-verdict idea already exists for WordPress and could be cloned quickly for PHP2Shell.

• Assetnote php2shell-scanner

  A high-fidelity, open-source vulnerability scanner for both CVEs. It answers whether a host is vulnerable, not whether it was broken into. Other free exposure scanners include zarguell, pentestershell, CyberRoute, 0xrsydn, JoasASantos and bladehstream.

• MakFly php2shell-check

  Checks for and applies the PHP2Shell fix on hosts, SSH servers and Docker images. It covers patching, not looking back for compromise.

• Imunify360 / ConfigServer eXploit Scanner / Linux Malware Detect

  The tools small hosts already run to scan every account on a cPanel server for web shells and malicious uploads. Imunify360 is sold through the cPanel store. None of them was shown to have a PHP2Shell-specific mode or to rank accounts by how likely they are to be compromised. They are the obvious incumbents who could add that.

• Vendor and host triage guides (Sophos, PHP2Shell.uk, Safeguard, xCloud)

  Free manual checklists covering log signals, admin accounts, PHP files in uploads and WP-CLI checksum checks. Sophos is at https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell and Safeguard's WordPress guide is at https://safeguard.sh/resources/blog/php2shell-wordpress-sites-what-to-do. They set the expectation that this triage is free.

Checked 2026-10-23