About this scanner

This service, operated by Boost, helps organisations find websites that still run a PHP version affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619), so they can be patched.

If you saw this scanner in your logs

Someone used this tool to check whether your site is patched against PHP2Shell. The check is passive:

• One GET / over HTTPS (falling back to HTTP), following at most 3 redirects. No paths are guessed, no forms are submitted, no payloads are sent.
• User-Agent: Boost-PHP2ShellCheck/1.0 (+https://php2shell.insurtech.dev/about)
• Source address: 34.74.146.185
• Only response headers (X-Powered-By, Server, Set-Cookie) and CMS generator tags in the first 256 KB of the page are read.

To report abuse or opt out, email soc@boostinsurance.io, or block 34.74.146.185.

What we keep

Nothing about the domains you scan. Submitted lists and results are streamed back to your browser and are not stored or logged. Operational logs record only the requesting IP address, the number of domains and the count of each result, for abuse prevention.

Limits of a passive check

• Hidden versions. Many hardened servers set expose_php = Off or strip headers at a CDN. These show as "PHP, version hidden" or "No PHP detected". Absence of evidence is not proof of safety.
• Distribution backports. Debian, Ubuntu, RHEL and others patch old version numbers. A version that looks old may be fixed, and some (notably RHEL-family builds) don't add a package suffix at all, so we can't distinguish them.
• Front page only. PHP may run on other paths or subdomains that we don't request.
• Edge rewriting. A CDN or WAF may hide, rewrite or cache headers from the origin.

For certainty, check the PHP version on the server (php -v, or phpversion() in the web SAPI) and your package manager's security advisories.

Use policy

Only scan domains you're responsible for or have a legitimate reason to check, such as your own customers' sites under your service agreement. Scans are rate-limited per client.