Quantitative Scoring of GitHub PoCs for Safe Detection Engineering

php2shell is now a thing from the last week as PHP fixed CVE-2026-109618 and CVE-2026-109619 on 21 October. In the days leading upto the weekend, multiple proof-of-concept code were uploaded to GitHub and elsewhere. I’m publishing my algorithm to analyze repositories that are safe to run and which ones do their job. This analysis is based on the 1,414 repositories, uploaded and cloned between 23 and 25 October.

The Scoring Algorithm

Now a days, everyone uploads all proof-of-concept codes to GitHub. This the state of repositories, etc when you search for PoCs related to CVE-2026-109618, CVE-2026-109619.

I remember starting with RepoMetaScore and the OpenSSF Scorecard to do this. However, either did not suit me. They are good measures of how well a maintained software project is run, which is a different question from what I wanted to do. I wanted to know if a PoC repo is safe to use and does what it claims among other things and php2shell was the perfect opportunity to test it out.

I started with a 19 indicator supply-chain rubric (account age, signed commits, PR review, pinned Actions) and dropped most of it. The measure project maturity that three-day-old repos never have as is the case in most 0day directories. 1,149 of 1,414 repos have a single author and only 311 have CI workflows. GitHub verifies signatures on 571 of them, and 496 of those carry only GitHub’s own key for commits made in the web interface, so a signature mostly proves someone used the browser. All four lure repos are fully signed that way. This is what the algorithm do:

• Verify safety for status every repo: The algorithm starts with for verified malicious QID or a lure with no code. If there are prebuilt executables or archives in the repo or its release downloads, piping a download into a shell, aggregated code, Telegram promotion, a paid Cloudflare-challenge solver, or a hash mismatch it will be assigned as a caution note.
• Reliability score: A PoC scanner accuracy that has lab results will override every rule. If PHP’s official fix, controls a mitigation actually applies, rules that load in Suricata, Sigma or YARA. If the code is original or copy, signatures GitHub verifies against the author’s own key, more than one author, owner account age, organization (verified domains score highest), there’s another score. If the repository does not contain any prebuilt executables in the repo or its releases, no curl into a shell, pinned dependencies, no default-branch history rewritten after publication, there’s an addition.
• Guardrails: Each score shows its coverage, such as “9 of 11”. Two scores above can add at most 20 points over the content share. The amount of stars and AI authorship aren’t scored as stars can be bought and AI PoC slop is often unreliable.

I ask Claude to create an infographic and this is the algorithm:

Based on this algorithm, this is what the php2shell PoCs on GitHub look like. Most of these repos aren’t exploits at all. Scanners are the biggest group, and 989 repos (70%) have no stars.

What 1,414 PHP2Shell repositories actually contain

• Scanner or triage: 48034%
• Weaponized exploit: 24017%; 25% of the supplied list, 15% of the GitHub-search additions
• Patch or backport: 192
• Mitigation: 116
• Other: 109
• Docs only: 104
• PoC lab: 100
• Detection rules: 59
• Crash or DoS PoC: 9
• Lure or recon only: 5

The first 470 labels were checked by hand. The 944 added since come from a classifier plus rules on names and descriptions; a random sample of them was 73% right, and the wrong ones in it are fixed. Renamed repos counted once.

I validated some 470 repositories by hand and wrote an automatic classifier to complete the rest.

php2shell poc Languages

Python and shell scripts make up 62% of the set. PHP itself is the main language in only 106 repos, led by scanners (33) and PoC labs (25).

Primary language of 1,414 PHP2Shell repositories

• Python: 567
• Shell: 307
• PHP: 106
• JavaScript: 88
• Markdown only: 76
• Go: 26
• TypeScript: 24
• PowerShell: 24
• YAML: 21
• Rust: 18
• C: 15
• Empty repo: 30
• Everything else: 112Ruby, HTML, Zeek, Dockerfile, package files, images and more

The language with the most code in each repo.

CVE-2026-109618 and CVE-2026-109619: PoC Authors

Nearly a quarter of the repos say outright that an AI wrote some of the code. Repositories that removed the attribution don’t show up – unfortunately. Hence, I don’t score it: AI-written code can be right and hand-written code can be wrong.

Who wrote them, and what they claim

• Any hard AI-authorship sign: 32423% of 1,414
• Co-Authored-By trailer naming an AI tool: 281
• Agent instruction file, such as CLAUDE.md: 61
• AI committer email: 33
• The word vibecoded: 7
• Generated with tag: 4

• Exploit repos checked for overselling: 65
• Flagged by a text pass: 42phrases like one-shot RCE or 100% reliable
• Highest-starred flags read by hand: 6
• False positives among those six: 4lab-setup phrase, explicit not guaranteed, technical sentence, article title
• Claim untested, not contradicted: 2both call their ASLR stage automated

AI signals are a floor: only repos that left the attribution in. A repo can show more than one. Neither is scored.

Safety status:

Fortunately, I found no malware and no live callbacks. The two “do not use” repos are lures: one promotes a Telegram group and a paid scanner service, the other links a paid listing.

Safety status of 1,414 PHP2Shell repositories

• No red flags found: 1194
• Caution: 18680 pipe a download into a shell, 73 publish prebuilt executables as release downloads, 44 bundle executables in the repo, 6 promote Telegram, 3 aggregate other repos, 1 Discord, 1 paid Cloudflare-challenge solver, 1 hash mismatch
• Do not use: 2lures with no code: Telegram and paid scanner service, paid listing
• No code: 3230 empty repositories, 2 search-dork lists

One repo can have more than one caution reason. No malware or live callbacks found.

What GitHub’s Repositories tell us:

• Young accounts: 62 of the 1,328 owners created their GitHub account in the 30 days before disclosure. They own 64 repos, spread across every class.
• Organizations: 129 owners are organizations; 18 have verified domains.
• Release downloads: 149 repos publish release files the clone doesn’t contain, and 73 that aren’t patch repos ship prebuilt executables or archives there. Each of those gets a caution. Patch repos that ship packages get a note to check checksums instead.
• Rewritten history: 124 repos force-pushed over their default branch after publishing. GitHub’s push events no longer say when a push was forced, so I found these by checking each push’s previous commit against my clones.
• Renames and empty repos: 8 renamed repos pointed at another repo already in the set and are counted once. 30 repos are empty: a name and nothing else.
• Stars: GitHub’s stargazer list is now limited to a repositories admins, so I used the 4,288 star events in the repos’ event feeds, from 3,516 accounts. The typical account was over six years old when it starred. One cluster stands out: 97 accounts created on 24 October each starred assetnote, 9bie or openai’s checker, a median of three minutes after signing up, and 74 of them are empty. That’s 7%, 3% and 1% of those repos’ stars. New users signing up to star a trending repo and a star service look the same in public data. Stars aren’t scored either way.

The lab-verified scores

40 scored repos went through a real test: 37 scanners against four PHP targets, and three community backports built into PHP 7.4.33. pentestershell’s scanner was tested too, but the repo also ships exploit code, so it has a status and no score. These are the scores I’d trust most.

assetnote/php2shell-scanner

• Content 44 of 50: correct on all four targets
• Provenance 30 of 30: verified org, verified signatures, older account
• Hygiene 15 of 20: unpinned dependencies

89

Sends probe requests and reads the response. Coverage 12 of 12.

Use

offseq/php2shell-poc

• Content 50 of 50: correct on all four targets
• Provenance 18 of 30: single author, unsigned
• Hygiene 20 of 20

88

Its OOM check reports a reachable trigger only on unpatched PHP. Coverage 11 of 11.

Use the OOM check

Anton-Barinov/php2shell-patches

• Content 50 of 50: matched the official fix and kept upload progress working
• Provenance 16 of 30: shares files both ways with another repo, unsigned
• Hygiene 16 of 20: unhardened CI workflow

82

Coverage 12 of 12. The 8.1 variant drops PHP's opcache and error-state changes; read from the patch, not tested.

Use the 7.4 enhanced patch

zarguell/php2shell-scanner

• Content 35 of 50: active check right on all four, version check flags the back-patched host
• Provenance 25 of 30: verified signatures, more than one author
• Hygiene 15 of 20: unpinned dependencies

75

Reports VULNERABLE(oracle) and LIKELY_VULNERABLE(version) separately; only the first held up. Coverage 13 of 13.

Trust its oracle verdict only

vegeta2206/php2scan

• Content 44 of 50: correct on all four targets
• Provenance 9 of 30: copy of assetnote with changes, single author
• Hygiene 20 of 20

73

85% of its code lines match assetnote's scanner. Coverage 11 of 11.

Use assetnote's original

mspiq/php2shell-scanner

• Content 20 of 50: flagged the back-patched target as vulnerable
• Provenance 15 of 30: single author, unsigned, no org
• Hygiene 15 of 20: unpinned dependencies

50

Was 80. It reads the version from phpinfo, and my earlier back-patched target leaked the real 8.4.27 there. Coverage 13 of 13.

Confirm by advisory

appsec-cz/php-eol-patch

• Content 28 of 50: fixes the session path, handles OOM the same as unpatched
• Provenance 16 of 30: single author, unverified org, includes files from another repo
• Hygiene 20 of 20

64

Coverage 10 of 10.

Prefer the official patch

Bhavye-Malhotra/php2shell-2026

• Content 0: same as unpatched PHP on every test
• Provenance 17 of 30
• Hygiene 20 of 20

20

Capped: provenance and hygiene can't lift a patch that changes nothing. Coverage 10 of 10.

Do not rely on it

Everything else

The other 990 defensive repos are scored from static checks plus GitHub’s API data. Treat this as a shortlist to read, not a verdict.

Class	Repos	Median	80 or more	Under 50	Highest static scores
Scanner / triage	443	60	0	63	SGit-AI (78), Trupal25 (77)
Patch / backport	188	63	31	34	bogdik (90), fiecar (90)
Mitigation	116	71	27	10	syhunt (93), pichuang (92)
Detection rules	59	52	5	27	rjmendez (90), umbrasec-labs (85)
Docs	75	78	35	17	Akirapl (95), NCSC-NL (91)
Other	109	68	35	29	allixsenos (92), WaldemarEnns (90)

Static scores rest on code, text and account data, not tests. The best static scanners, SGit-AI at 78 and Trupal25 at 77, haven’t been tested. Of the 37 scanners I did test, 5 got every target right. A high mitigation score means the repo applies its controls well, not that it protects you; no config change closes both bugs.

How the scores spread

How 1,030 reliability scores spread

• 90 to 100: 15
• 80 to 89: 121
• 70 to 79: 142
• 60 to 69: 341
• 50 to 59: 225
• 40 to 49: 90
• 30 to 39: 30
• 20 to 29: 66

Defensive repos only. 40 are lab-verified, the rest static.

Most repos land between 50 and 79. Only 15 score 90 or more. The 186 under 50 are spread across classes: 68 scanners, 35 patches, 29 other, 27 detection repos, 17 docs and 10 mitigations. Stars and the score barely agree: the rank correlation is 0.10 across the 1,030 graded repos.

Scanners that read the banner get distro fixes wrong

Ubuntu, RHEL and cPanel ship fixes without changing the version number. I served four targets (vulnerable 8.4.26, patched 8.4.27, patched with the version hidden, and fixed code that reports 8.4.26 in every header and page) and ran 46 scanners against each, in their default modes.

46 php2shell scanners against four lab targets

• Correct on all four: 5assetnote, offseq, medandevsec, and vegeta2206 and vintage-alt, both built on assetnote's code
• Partial: 1zarguell: its active check clears the back-patched host, its version check still flags it
• False positive on the back-patched host: 27includes mspiq, JoasASantos, Galeax, CyberRoute, rodrigocolozio
• Calls patched 8.4.27 vulnerable: 30xBlackash, TahuCryptsi, fellipgomes
• Crashed or gave no verdict: 2rootabhi1, benzeng
• Couldn't run in this lab: 8needs a setup step, HTTPS or subdomain input only, or an app that starts a session

Targets: vulnerable 8.4.26, patched 8.4.27, patched with the version hidden, and fixed code that reports 8.4.26 everywhere, the way Ubuntu, RHEL and cPanel ship fixes. Default mode only, no exploit flags.

Only five told the back-patched host apart from the vulnerable one, and two of those five are built on assetnote’s code (85% and 77% of their lines). mspiq, which I’d graded correct on 23 October, reads the version from phpinfo. My first back-patched target leaked the real 8.4.27 there. A real back-patched build doesn’t, so I fixed the target and mspiq now gets the same false positive as the rest.

Reading the version from X-Powered-By or phpinfo gets distro fixes wrong every time. Confirm distro fixes by vendor advisory or package changelog, and pick a scanner that sends a probe and reads the response.

Which PoCs work

Finally,

CVE-2026-109619: session upload progress

• 8.4.26: the upload-progress handler resolves classes and runs the unserializer before the request starts
• 8.4.27: clean result, no user code runs
• Both rfc1867 session tests fail on 8.4.26 and pass on 8.4.27

Real on default settings

The primitive the gadget PoCs need is present on unpatched defaults.

Code execution still needs a usable gadget in the target app and an ASLR defeat, which is why the serious repos only demo against their own lab.

Patch first

CVE-2026-109618: out-of-memory state corruption

• 8.4.26: a huge per-part header count exhausts memory mid-parse
• 8.4.27: all 11 OOM and rfc1867 tests pass
• Getting from the crash to code execution depends on build, extensions and allocator

Trigger is reliable

Most 109618 repos show a crash or DoS, not RCE.

Patch, watch hosts

Interestingly, Hunt.io saw php2shell scanning switch to the user-agent php2shell-109618 at 20:36 UTC on 21 October. I searched my clones and GitHub’s code search for it and for Hunt’s two other indicator strings, php2shell-scan/109618 and php2shell-verify/1.0.

Repo	Created (UTC)	Sends	Note
zhaoboy9692/CVE-2026-109618	21 Oct 03:24	php2shell-109618	earliest; copied verbatim by charindithjaindu
cereZ23/php-up-2026	21 Oct 07:40	php2shell-109618	shares a framework with zhaoboy9692
darkfibr/php2shell-detect	21 Oct 08:31	php2shell-109618	a scanner
eness PoC (983★)	21 Oct 08:31	php2shell-109618	in its 109618 PoC from 08:46 until removed on 22 Oct
CYB3RW07F, giagara, Ghxstsec, JohnHansonTheDev, k3nundrum, Faizan-Khanx, ethernet8023	21 Oct 09:50 to 18:37	php2shell-109618	several inherit it from eness

Twelve repos sent php2shell-109618 before the scanner adopted it. The two earliest sources are zhaoboy9692 and eness, and copies of both carried it on. That fits a botnet reusing public PoC code. A user-agent is a string anyone can copy, so it’s a lead, not proof. Five later repos send the strings too, including test harnesses that mimic the scanner, and 40 more only quote them in detection rules.

Want to have a detailed look at the data collected? Here it is: The 1,030 defensive repos, highest score first within each class. Coverage counts the indicators that applied to that repo. “Lab” means the score rests on a real test. Safety “clear” means no red flags found, not proven safe. Exploit and PoC repos, lures and empty repos have a safety status only; they’re in the CSV with everything else.

Scanners and triage (480) (click to expand)

6512 of 12

Repo	Score	Coverage	Tested	Safety	Origin
assetnote/php2shell-scanner	89	12 of 12	lab	clear	original
offseq/php2shell-poc	88	11 of 11	lab	clear	original
SGit-AI/SGit-AI__Website__Newsroom__2026__Oct__PHP	78	13 of 13	static	clear	original
hfenner/phpdetect	77	13 of 13	static	clear	original
Trupal25/php2shell-audit	77	12 of 12	static	clear	original
kaiste99/php2shell-web-check	75	14 of 14	static	clear	original
Mikael-Lelouch/php2shell-mitigation	75	13 of 13	static	clear	original
scardotdev/php2shell-helper	75	12 of 12	static	clear	original
zarguell/php2shell-scanner	75	13 of 13	lab	clear	original
junsuwhy/php2shell.tw	74	13 of 13	static	clear	original
annejan/crisus	73	13 of 13	static	clear	original
EXT-IT/php2shell-check	73	13 of 13	static	clear	original
vegeta2206/php2scan	73	11 of 11	lab	clear	copy of assetnote with changes
CODEMaster-284/php2shell-audit	72	12 of 12	static	clear	original
CptNope/PHP2Shell-WP-scanner	72	13 of 13	static	caution	original
duytien241/check-php2shell	72	12 of 12	static	clear	original
getastra/php2shell-triage	72	12 of 12	static	clear	original
it-reinbek/php2shell-auditor	72	12 of 12	static	clear	original
lbd226/php2shell	72	13 of 13	static	caution	original
LonglifeX/php2shell_checker_ubuntu_fpm	72	12 of 12	static	clear	original
Maneppagolmanju/php2shell-safe-poc	72	12 of 12	static	clear	original
mrkevops/skills	72	12 of 12	static	clear	original
mrmitkov/php-security-exposure-audit	72	12 of 12	static	clear	original
openai/php2shell-checker	72	12 of 12	static	clear	original
vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy	72	11 of 11	lab	clear	reuses code from assetnote
Bluefire-Redteam-Cybersecurity/bluefire-php2shell-guard	70	12 of 12	static	clear	original
chipzon/phpcheck	70	12 of 12	static	clear	original
kometsoft/php2shell-check	70	12 of 12	static	clear	original
lankahost/lankahost-php-patch-check	70	12 of 12	static	clear	original
phyowaiyan-dev/php-runtime-security-checker	70	13 of 13	static	clear	original
RogerBergling/PHP2SHELL-CHECKER	70	12 of 12	static	clear	original
Secure-Cyber-Defense/PHP2Shell-Compromise-Check	70	12 of 12	static	clear	original
SPOTWHALE/php2shell-check	70	12 of 12	static	clear	original
The-DevOps-Daily/php2shell-check	70	13 of 13	static	clear	original
toxy4ny/php2shell-checker	70	13 of 13	static	clear	original
WeMakeGood/php2shell	70	12 of 12	static	clear	original
alternat0r/php2shell-patches	69	12 of 12	static	clear	original
rioru/php-zif-offsets	69	12 of 12	static	clear	original
suominen/php-20261021	69	12 of 12	static	clear	original
YoungOnef/php2shell-observatory-data	69	14 of 14	static	clear	original
5WARM-AI/php2shell-check	68	12 of 12	static	clear	original
Anwar0904/php2shell-guard	68	14 of 14	static	clear	includes files from santinohicke
cseelhoff-ms/php2shell-hunting-pack	68	13 of 13	static	clear	original
EtherHamRadio/asl-node-check	68	12 of 12	static	clear	original
Galeax/php2shell-scanner	68	12 of 12	lab	clear	original
Kickala/php-vulnerability-checker	68	12 of 12	static	clear	original
packet-perf/dt-pp-dashboard-PHP2Shell	68	12 of 12	static	clear	original
aancw/php2shell-scanner	67	13 of 13	static	caution	original
aaron4415/Critical-CVE-Response-Legacy-Upgrade-Assistant	67	12 of 12	static	clear	original
Ahamisi/open-patch	67	14 of 14	static	caution	original
AmanSin001/php2shell-check	67	12 of 12	static	clear	original
beardedeagle/php2shell-patch-audit	67	13 of 13	static	clear	original
covertswarmlabs/PHP2Shell-Check	67	13 of 13	static	clear	original
danrod96-new/php-patch-check	67	12 of 12	static	clear	original
dhruvmehra/php-js-security	67	12 of 12	static	clear	original
earlkun-ngga/ipeh	67	12 of 12	static	clear	original
falco81/OTP	67	12 of 12	static	clear	original
GeraldGeniaut/check-php2shell.sh	67	12 of 12	static	clear	original
guisn/php-server-security-response-skill	67	12 of 12	static	clear	original
h3r2ym/Check-PHP-Docker-CVE-2026-109618—109619	67	12 of 12	static	clear	original
Heroic297/php2shell-patcher	67	12 of 12	static	clear	original
hiramcoop/php2shellscan	67	12 of 12	static	clear	original
Jamsux/php2shell-check	67	12 of 12	static	clear	original
kauecodify/5.	67	12 of 12	static	clear	original
KByteITServices/php-vulnerability-checker-october-2026	67	12 of 12	static	clear	original
Kernovix/php2shell-fix-check	67	13 of 13	static	clear	original
Kindredman/php2shell-host-audit	67	12 of 12	static	clear	original
kowalski-analysis/php2shell-checker	67	12 of 12	static	clear	original
lankahost-dev/lankahost-support	67	12 of 12	static	clear	original
luivc1/php-vuln-responder	67	12 of 12	static	clear	original
lukd06/php-rce-check	67	12 of 12	static	clear	original
maladwani/php-security-inventory	67	12 of 12	static	clear	original
medandevsec/cvephpreact2026	67	12 of 12	lab	clear	original
mehmetkuruyuz/php-cve-audit	67	12 of 12	static	clear	original
msoni11/msphp2shell	67	12 of 12	static	clear	original
NASITSolutions/php-security-check	67	12 of 12	static	clear	original
neoqmin/php2shell	67	12 of 12	static	clear	original
Nikba-Creative-Studio/php2shell-checker	67	12 of 12	static	clear	original
PaulTimmins/php2shell-scanner	67	13 of 13	static	clear	original
pepperhot/php	67	12 of 12	static	clear	original
PerronSoftware/php2shell	67	12 of 12	static	clear	original
prianto/php2shell-checker	67	12 of 12	static	clear	original
psylinux/php2shell-check	67	12 of 12	static	clear	original
SedatOzdemir/php2shell-checker	67	12 of 12	static	clear	original
serdel1979/check-cve-php	67	12 of 12	static	clear	original
shivrajem/php2shell-detect	67	12 of 12	static	clear	original
Snikeer/PHP2shell-detection-lab	67	12 of 12	static	clear	original
StefanMuellerAI/php2shell	67	13 of 13	static	clear	original
Suman99pro/php2shell-check	67	12 of 12	static	clear	original
swap18plus/php2shell_CVE-2026-109618-and-CVE-2026-109619	67	12 of 12	static	clear	original
thetrueartist/php2shellScanner	67	12 of 12	static	clear	original
wasdthedebugger/php2shell	67	12 of 12	static	clear	original
wattop727-cpu/php2shell-lab	67	12 of 12	static	clear	original
5dmgmt/repo-health-kit	66	12 of 12	static	clear	original
sqzer-x/php2shell-scanner	66	14 of 14	static	clear	original
benzaid32/php2shell-remediation-kit	65	13 of 13	static	clear	original
bladehstream/php2shell_detect	65	12 of 12	static	caution	original
citypeople/php2shell	65	12 of 12	static	clear	original
covertswarmlabs/PHP2Shell-local-checker	65	12 of 12	static	clear	original
CVEChecker26/dyd	65	14 of 14	static	clear	original
EfraimDiveroli-Pwn3d/PHP2shell_nuclei_templates	65	12 of 12	static	clear	original
EmmanuelMmanda/devops-toolbox	65	13 of 13	static	clear	original
g-seller/security-php-incident-26102026	65	12 of 12	static	clear	original
GarphenGate/php2shell-defender-toolkit	65	12 of 12	static	clear	original
GetPageSpeed/php2shell-check	65	13 of 13	static	caution	original
hanyuanchen08-netizen/php-exposure-audit	12 of 12	static	clear	original
hyderoo/php2shell-check	65	13 of 13	static	clear	original
JKUL-png/php2shell-selfcheck	65	12 of 12	static	clear	original
JoasASantos/php2shell-scanner	65	12 of 12	lab	clear	original
krisztianhari-wq/php2shell-scan	65	13 of 13	static	clear	original
maikbehring/php-contingency-mode	65	13 of 13	static	clear	original
milantgh/php2shell	65	12 of 12	static	clear	original
phuongnguyenitpro/php2shell	65	13 of 13	static	clear	original
Quaerendir/php2shell-audit	65	13 of 13	static	clear	original
sanjayws/phpchecker	65	14 of 14	static	clear	original
seguridadentrerios/CVE-2026-109618-CVE-2026-109619	65	12 of 12	static	clear	original
Skittel/php-patchkit	65	12 of 12	static	clear	original
AaronGrace978/PHP-Scanner	64	14 of 14	static	clear	original
Incerto-inc/php-vuln-check-2026-10	64	13 of 13	static	clear	original
actions-marketplace-validations/Amsozzer1_php2shell-repo-audit	63	14 of 14	static	clear	GitHub Marketplace mirror of Amsozzer1
aehcktrn/php2shell-scanner	63	13 of 13	static	clear	original
CompleTetech-Security/php2shell-check	63	13 of 13	static	clear	original
Continuum-AI-Corp/orcacyber-php2shell-research	63	12 of 12	static	clear	original
ericmann/php2shell-ioc	63	13 of 13	static	clear	original
fschell/tools	63	13 of 13	static	clear	original
HaveIbeenPHPned/haveibeenphpned.github.io	63	14 of 14	static	clear	original
jeanccoelho/php2shell-check	63	13 of 13	static	clear	original
Nguemoue/project2026_20261024_php2shellcheck	63	13 of 13	static	clear	original
ruslanty/php-runtime-audit	63	14 of 14	static	clear	original
squiblyza/CVE-2026-109618-CVE-2026-109619	63	13 of 13	static	clear	original
ZeroHunt-org/self-check	63	13 of 13	static	clear	original
zNexoraTech/php2shell-detector	63	13 of 13	static	clear	original
alekhakumarswain/PHP2Shell	62	12 of 12	static	clear	original
alesiancyber/php2shell_research	62	13 of 13	static	clear	original
aprian1337/php2shell-lab	62	12 of 12	static	clear	original
arifulislamat/php2shell-audit	62	14 of 14	static	caution	original
bewithdhanu/php-safe-upgrade	62	12 of 12	static	caution	original
cheton/php2shell	62	13 of 13	static	clear	original
codref/php2shell-remote-check	62	12 of 12	static	clear	original
ctkqiang/PHP2ShellPOC2026	62	12 of 12	static	clear	original
daehyuh/weak-php-finder	62	12 of 12	static	clear	original
ethoic-inc/php-vuln-check	62	14 of 14	static	caution	original
hhhhub000/phpchecker	62	13 of 13	static	clear	original
juliosuas/php2shell-check	62	13 of 13	static	clear	original
kaaangumus/php2shell-nuclei (deleted)	62	10 of 12	static	clear	original
kiran-ox/php2shell-check	62	13 of 13	static	caution	original
manshoor/php2shell-scanner	62	13 of 13	static	clear	original
MarioAgbanobi/php2shell-lab	62	12 of 12	static	clear	original
mbadis-dev/php-cve-2026-109618-toolkit	62	12 of 12	static	clear	original
mbelsis/php2shell_scan	62	13 of 13	static	clear	original
mothproof3512/php2shell-scan	62	12 of 12	static	clear	original
msuiche/php2shell_waf_check	62	12 of 12	static	clear	original
nirzadokox/php2shell-vulnerability-check-for-CVE-2026-109618-CVE-2026-109619	62	12 of 12	static	clear	original
pawal/php2shell	62	13 of 13	static	caution	original
Prathewsh/FreeTools	62	13 of 13	static	clear	original
rattones/php2shell-check	62	12 of 12	static	clear	original
RobertoCifre/php2shell-check	62	12 of 12	static	clear	original
tarun1sisodia/PHP2SHELL	62	13 of 13	static	clear	original
xaviware/go-php2shell-scanner-CVE-2026-109618-CVE-2026-109619	62	12 of 12	static	clear	original
yuvarajan1989k/php2shell-linux	62	12 of 12	static	clear	original
AlexVargasV/php2shell-response-kit	61	14 of 14	static	clear	original
aumlayer/security-labs	61	12 of 12	static	clear	original
Charlie-Netdevops/php2shell-hostcheck	61	13 of 13	static	clear	original
Evil0ctal/php2shell-scanner	61	12 of 12	static	caution	original
Goddy01/FourIsNotRandom	61	14 of 14	static	clear	original
Riftweld/php2shell-repro	61	12 of 12	static	clear	original
Secragon/php2shell-radar	61	14 of 14	static	caution	original
the-metafactory/php-patch-verify	61	12 of 12	static	clear	original
vidocsecurity/php2shell-defend	61	12 of 12	static	clear	reuses code from assetnote
YSGoh/Php2shell-	61	12 of 12	static	clear	copy of mbadis-dev with changes
0xRichtofen/php2shell-detector	60	12 of 12	static	clear	original
1Nightlovel/CVE-2026-109618	60	12 of 12	lab	clear	original
1Nightlovel/CVE-2026-109619	60	12 of 12	lab	clear	original
3tternp/PHP2SHELL_check	60	12 of 12	static	clear	original
AbelLykens/php2shell-checker	60	12 of 12	static	clear	original
abenezer101/php2shell	60	14 of 14	static	clear	original
aceptriana/php2shell	60	13 of 13	static	clear	includes files from assetnote
adhie401/php2shell-toolkit	60	12 of 12	lab	clear	original
AIjennings/aria-agent-blueprints	60	12 of 12	static	clear	original
AIjennings/ariawave-php2shell-scanner	60	12 of 12	static	clear	original
alanh0vx/php2shell-check	60	12 of 12	lab	clear	original
alekzihz/vulnerabilidad-php-2026-109619-18	60	12 of 12	static	clear	original
alex-red/2026-october-security-scan	60	13 of 13	static	caution	original
alham-rizvi/php2shell-scanner	60	12 of 12	static	clear	original
alvaroguzmancode/CVE-2026-109618	60	12 of 12	static	caution	original
Anon0ne/PHP2Shell-check	60	12 of 12	static	caution	original
brentmartinmiller/php2s hell-check	60	12 of 12	static	clear	original
cavanaughdesign/php-vulnerability-remediation	60	13 of 13	static	caution	original
chadpierce/php2shell_probe	60	12 of 12	static	clear	original
chrisdfir/php2shell-detection	60	12 of 12	static	clear	original
ChriZzn/phphunt	60	12 of 12	static	caution	original
codesource/cve-check	60	12 of 12	static	caution	original
cybermaksx/php2shell-check	60	13 of 13	static	clear	original
derazo1/php2shell-scanner	60	12 of 12	static	clear	original
digitalfuturecol-dev/df-security-check	60	14 of 14	static	caution	original
dinvisible1/nmap-php2shell	60	12 of 12	static	clear	original
DitohartoPramudya/check_php2shell	60	12 of 12	static	clear	original
Flookerton/Am-I-Pwned	60	12 of 12	static	clear	original
gei-git/php2shell-poc	60	12 of 12	static	clear	original
GlobalsecureAcademy/php2shell-scanner-CVE-2026-109618-CVE-2026-109619	60	12 of 12	static	clear	original
guoziyu415/php2shell-check	60	13 of 13	static	clear	original
heisnature1/pentesting_2	60	13 of 13	lab	clear	original
iczombie4/php2shell-checker	60	12 of 12	static	clear	original
jgatka/php2shellcheck	60	13 of 13	static	clear	original
johanych/php2shell-checker	60	12 of 12	lab	clear	original
karthikvenkatachalapathi/PHP2Shell-vulnerability-identification	60	12 of 12	static	clear	original
KyleClouthier/php2shell-check	60	12 of 12	static	clear	original
larsactionhero/php-patch-check	60	12 of 12	static	clear	original
Magicalname/php2shell-guard	60	12 of 12	static	clear	original
makanSukros/php-skeptic	60	12 of 12	static	clear	original
masteread/php2shell-checker-claude	60	13 of 13	static	clear	reuses code from openai
mohamedation/php2shell-scanner	60	12 of 12	lab	clear	original
momokii/php2shell-audit	60	14 of 14	static	clear	original
muhammad-luay/php2shell-repro	60	12 of 12	static	clear	original
nao-t-dev/Oct21-PHP-risk-inspector	60	13 of 13	static	clear	original
nbehar/php2shell-scanners	60	12 of 12	static	clear	original
newtro/php2shell-site-check	60	13 of 13	static	clear	original
ngankt2/php2shell-check	60	12 of 12	static	caution	original
nocerainfosec/php2shell-checker	60	12 of 12	static	clear	original
nukIeer/CVE-2026-109618-109619-checker	60	12 of 12	static	clear	original
nukIeer/php2shell-checker	60	12 of 12	static	clear	original
ovtechnology/php2shell-check	60	12 of 12	static	clear	original
PaulCybersec/php2shell_scanner	60	12 of 12	static	clear	original
Pauloxc6/php2shell-check	60	12 of 12	static	clear	original
pentestersn/php2shell-scanner	60	12 of 12	static	clear	original
pixexid/website-maintenance	60	12 of 12	static	clear	original
psylinux/php2shell-nuclei-template	60	12 of 12	static	clear	original
Py0x11/php2shell-detection	60	12 of 12	lab	clear	original
Rahat463/patchferry-check	60	12 of 12	static	clear	original
resulcaglayan/php-cve-audit	60	12 of 12	lab	clear	original
ridhabnj/php2shell-check	60	12 of 12	static	caution	original
Robertkiza0/php2shell-lab	60	12 of 12	static	clear	original
rodrigocolozio/php2shell-check	60	12 of 12	lab	clear	original
rpendleton/php-scan	60	13 of 13	static	clear	original
rpersak/php2shell_check	60	12 of 12	static	clear	original
sajjadh47/php2shell-php	60	14 of 14	static	caution	original
Sanal-Lince/PHP-Shell-v0.3	60	12 of 12	static	clear	original
securibee/php2shell-tenable-skill	60	12 of 12	static	clear	original
Senturkselim/Am-I-Infected	60	12 of 12	static	caution	original
skwirrel/php-cve-2026-109618-check	60	12 of 12	static	clear	original
sprashun/php-patch-check	60	12 of 12	static	clear	original
Stensel8/check-for-CVE-2026-109618-CVE-2026-109619 (deleted)	60	9 of 11	static	clear	original
sxyrxyy/php2shell-cve-2026-109618-check	60	12 of 12	static	caution	original
toopster-com/php2shell-check-for-claude	60	13 of 13	static	caution	original
witoldwitkowski/PHP-iot-finder	60	14 of 14	static	caution	original
wromansky/php2shell-warn	60	12 of 12	static	clear	original
x0xr00t/sl0ppy-php2shellscan	60	12 of 12	static	clear	original
xPloits3c/PHP2Shell (deleted)	60	9 of 11	static	clear	original
yu1row/php-cve-2026-check	60	12 of 12	static	clear	original
ZirHuan/security-fixes	60	12 of 12	static	caution	original
adityaaravind/php2shell-check	59	14 of 14	static	clear	original
atarus-security/atarus-phpcheck	59	14 of 14	static	clear	original
grupooruss/php2shell-assessment-global	59	12 of 12	static	clear	shares files with EkaterinaMarchetti (order unclear)
k4ran909/php2shell	59	12 of 12	static	clear	copy of openai
Liam-G/php2shell-audit	59	14 of 14	static	clear	original
sohailgoheer/punjab-trees	59	14 of 14	static	clear	original
tw365-org/php2shell-checker-cf	59	14 of 14	static	clear	shares files with openai (order unclear)
yehezkiel1086/php2shell-check	59	13 of 13	static	clear	original
AdZoic/php2shell-check	58	13 of 13	static	caution	original
coldcain-sec/php2shell-checker	58	12 of 12	static	clear	original
DefectDojo/earlylight	58	13 of 13	static	caution	original
Flese/php2shell-banner-check	58	13 of 13	static	clear	original
flexEST/php2shell_checker	58	13 of 13	static	clear	original
fmdiscioglu/php-cve-2026-109619-checker	58	12 of 12	static	clear	original
inematds/auditoria-seguranca	58	13 of 13	static	caution	original
JackLiKa/php2shell-scan	58	12 of 12	lab	clear	original
jamielsp2/PHP2SHELL-POC	58	12 of 12	static	clear	includes files from KarimUD7
Joepify/joepify-kennisbank	58	static	clear	original
K4ySuh/php-oneshot-checker	58	13 of 13	static	clear	original
latadeloco/agent-php2shell	58	13 of 13	static	caution	original
magekwik/php-rce-check	58	12 of 12	static	caution	original
mejustbox-byte/CVE-2026-109618-CVE-2026-109619	58	12 of 12	static	caution	original
najibdigital/php2shell-scanner	58	12 of 12	lab	clear	original
pagvac/php2shell-detect	58	14 of 14	static	clear	original
pinelta/PIN-PUBLIC-PHP2SHELL-SCANNER	58	13 of 13	static	clear	original
puffert/php-critical-rce-scanner	58	13 of 13	static	clear	original
StuMP90/apt-watch	58	13 of 13	static	caution	original
vyaktigat1326/scs-php2shell-detection-test	58	14 of 14	static	caution	original
vynazevedo/php2shell-scanner	58	13 of 13	static	clear	original
want3d04/woxeshell	58	12 of 12	static	clear	original
antiburen/PHP2Shell-Probe	57	12 of 12	static	clear	original
brunoalex55/busca-vagas	57	13 of 13	static	clear	original
genetix/php2shell-diagnostic	57	12 of 12	static	clear	original
H2H2-ENG/123	57	12 of 12	static	clear	copy of openai
hoed/php2shell	57	14 of 14	static	clear	original
marcelmeir/php2shell-assessor	57	14 of 14	static	clear	original
securin-public/php2shell-checker	57	14 of 14	static	clear	original
sonuoffsec/php2shell-detector	57	13 of 13	static	caution	original
viviopenclaw-code/php2shell-audit	57	12 of 12	static	caution	original
WaldemarEnns/2shell-site	57	13 of 13	static	clear	original
Arwy07/php2shell-remediation-guide	56	12 of 12	static	caution	shares files with pepperhot (order unclear)
AyaanB-DotCom/Eclipse-P2S	56	13 of 13	static	clear	original
aym-sec-engineer/vulnops-lab	56	14 of 14	static	clear	original
bianqiang-ui/phpscan-go	56	13 of 13	static	caution	original
hoehyeonlab/php-cve-2026-109618-check	56	13 of 13	static	caution	original
jorgbot/PHP2Shell	56	14 of 14	static	clear	original
jzgyhlove/php2shell-windows	56	13 of 13	static	caution	includes files from murrez
PHPatch/phpscan	56	14 of 14	static	clear	original
spcaeo/php2shell-check	56	14 of 14	static	clear	original
Swordsec/php2shell-guard	56	13 of 13	lab	clear	original
unbelievable-digital/is-my-php-pwned	56	12 of 12	static	caution	original
wemio/php2shell-scan	56	13 of 13	static	clear	original
aayyagar/php-vuln-scanner	55	12 of 12	static	clear	original
abdallahi34/php2shell	55	12 of 12	static	clear	original
Aman9520/php2shell-scAnner	55	13 of 13	lab	clear	original
anthonyhann/php-crisis-toolkit	55	12 of 12	static	clear	original
bxsic-fr/php2shell_responder	55	12 of 12	static	clear	original
ChristianMarzianGithub/php2shellCehcker	55	13 of 13	static	clear	original
colinyy/php2shell-exposure-check	55	13 of 13	static	clear	original
CyberRoute/php2shell-scanner	55	12 of 12	lab	clear	original
dustyFski/php2shell-exposure-accelerator	55	13 of 13	static	clear	original
egctl/php2shell	55	13 of 13	static	clear	original
finalgod2003/phpchecker	55	13 of 13	static	clear	original
KnickLighter/p2selfcheck	55	12 of 12	static	clear	original
kunshdeep2812/php2shell-scanner	55	13 of 13	lab	clear	original
laurentlevi/dt-managed-php-versions	55	12 of 12	static	clear	original
lechu77/simple-php2shell-checker	55	13 of 13	static	clear	original
lzz0403/CVE-2026-109618-PHP2Shell-poc	55	12 of 12	static	clear	original
mchopan/PHP-Vulnerability-Chacker	55	13 of 13	static	caution	original
misfist/wp-site-audit	55	12 of 12	static	clear	original
nextmend/api-runtime-vulnerabilities-demo	55	14 of 14	static	clear	original
pop372440-art/https-github.com-openai-php2shell-checker	55	12 of 12	static	clear	copy of openai
Pr0fEs0r-X/PHP2ShellX-	55	13 of 13	static	clear	original
Prajjwal-Srivastava/php2shell_scanner	55	12 of 12	lab	clear	original
shayanabbas/php2shell-checker	55	13 of 13	static	clear	original
somisec/php2shell-scanner	55	12 of 12	static	clear	original
suleymanpetek/shadowphp	55	12 of 12	static	clear	original
summoningshells/php2shell-check	55	12 of 12	static	clear	original
tismayil/php2shellcsp	55	12 of 12	lab	clear	original
tobiastillstam/Scan-PHP2Shell	55	12 of 12	static	clear	original
triscravello/php-patch-check	55	12 of 12	static	clear	original
tuend-work/linux-auto-patch-toolkit	55	12 of 12	static	clear	original
VineetKamath/phpagent	55	14 of 14	static	caution	original
walt3rblake/php2shell-scanner	55	13 of 13	static	clear	original
xqus/php2shell-check	55	12 of 12	static	clear	original
yanzyuyu/php2shell-prtct	55	12 of 12	static	clear	original
Zeppperoni/PHP2Shell-detector	55	12 of 12	static	clear	original
zer0lightning/PHP2List	55	13 of 13	static	clear	original
ziezeeshan/php2shell-detection-lab	55	12 of 12	static	clear	original
0x4148/CVE-2026-109618-php2shell-lab	54	12 of 12	static	clear	original
actions-marketplace-validations/adityaaravind_php2shell-check	54	14 of 14	static	clear	GitHub Marketplace mirror of adityaaravind
bit-of-a-shambles/php-patch-check	54	14 of 14	static	caution	original
ead8/php2shell-scan	54	14 of 14	static	clear	original
emirwtz/php2shell	54	14 of 14	static	clear	original
emirwtz/php2shell	54	14 of 14	static	clear	original
fadlisaad/php2shell-dashboard	54	13 of 13	static	clear	reuses code from assetnote
flawme/php2shell-scanner	54	14 of 14	static	clear	original
hackersroot/PHP2Shell-detect	54	12 of 12	lab	clear	copy of spade-kk with changes
hoytnix/FTW	54	14 of 14	static	caution	original
Mojizhasan/patchhe ro	54	14 of 14	static	clear	original
ZiarenEASM/php2shell-probe	54	14 of 14	lab	clear	original
0xBlackash/CVE-2026-109618	53	12 of 12	lab	clear	original
arvion-ai/php-pins	53	14 of 14	static	clear	original
Certbn/PHP2Shell-CVE-2026-109618-CVE-2026-109619-	53	12 of 12	static	clear	original
darshan-Jahagirdar/protect	53	13 of 13	static	clear	original
digital-heroes-hamburg/wp-php2shell-check	53	12 of 12	static	clear	original
ferchosur/php-flaws-demo	53	12 of 12	static	caution	original
GambitMutant/aegis-coinbase-for-woocommerce	53	12 of 12	static	caution	original
h1-wh0areu/PHP-CVE-Scanner	53	12 of 12	static	caution	original
KarimUD7/RCE-POCKET-POC-for-PHP2SHELL	53	12 of 12	static	clear	reuses code from bastet-ai
kitten443/php2shell	53	12 of 12	static	clear	original
malikad778/php2shell-guard	53	14 of 14	static	caution	original
meghaInfosec/phpbleed	53	12 of 12	static	clear	original
Paolo-Monti/phpcheck	53	12 of 12	static	caution	original
paulamckenzie9193/php2shell-check	53	12 of 12	static	clear	original
scriptsnet/php2shell-security-toolkit	53	14 of 14	static	caution	original
spk-c/PenX	53	14 of 14	static	caution	original
ThePainter1939/php2shell-guard	53	12 of 12	static	clear	original
vyaktigat1326/scs-php2shell-artifacts	53	12 of 12	static	caution	original
waksboy/php-cve-2026-109618-109619-tester	53	13 of 13	static	clear	original
CyberRick-AI/php2shell-check	52	14 of 14	static	clear	original
D4RCKCYPH3R/php2shell-scan	52	13 of 13	static	clear	original
dpbingnet/php-runtime-check	52	12 of 12	static	clear	original
erickson558/php_cgi_validation	52	14 of 14	static	caution	original
EthicalHCOP/php2shell-Simple-Checker	52	12 of 12	static	clear	original
ICT154/php2shell-rce-scanner	52	13 of 13	lab	clear	original
joeneldeasis /php2shell-scan	52	13 of 13	static	clear	original
malebois/securisation-vps	52	12 of 12	static	clear	original
Ramikan/PHP2SHELL-Scanner	52	12 of 12	static	clear	original
salmandev/everything-gemini	52	14 of 14	static	caution	original
SideeID/php2shell	52	13 of 13	static	clear	original
v1xingyue/phpcheck-hids	52	13 of 13	static	caution	original
wulier-arch/surfacecheck	52	14 of 14	static	clear	original
0xgitpushpray/php2shell	51	13 of 13	static	caution	original
actions-marketplace-validations/hugomn_heldkeys	51	14 of 14	static	caution	GitHub Marketplace mirror of hugomn
alefkaue/php2shell-security-assessor	51	14 of 14	static	clear	original
fmdiscioglu/php-cve-2026-109618-checker	51	12 of 12	static	clear	original
nirajkhetre/slowship	51	14 of 14	static	caution	original
pjstein/fumigator	51	14 of 14	static	caution	original
s-cuadro-r/php2shell-check	51	13 of 13	static	clear	original
tritschler/rtms-public	51	14 of 14	static	clear	original
yananai-chiwuta/PHProtect	51	14 of 14	static	caution	original
0k1dok1/CVE-2026-109618-CHECK	50	12 of 12	static	clear	original
afe038/audit-php2shell	50	12 of 12	static	clear	original
akinerkisa/php2shell-one	50	14 of 14	static	clear	original
amnnrth/php2shell-safe-exposure-scanner	50	13 of 13	static	caution	original
anldori/CVE-2026-109618	50	12 of 12	static	clear	original
crazyvv/php2shell_check	50	14 of 14	static	caution	original
DilanWW/php-cve-check	50	13 of 13	static	clear	original
EkaterinaMarchetti/php2shell-assessment-global	50	12 of 12	static	clear	reuses code from grupooruss
er4pwn/php2shell-checker	50	13 of 13	static	clear	original
errorfo/php2shell	50	12 of 12	static	clear	original
kapoordeepanshu/php-version-scanner	50	13 of 13	static	clear	original
katsushi2441/kseccheck	50	12 of 12	static	clear	origina l
Morrowga/php-rce-risk-check	50	13 of 13	static	clear	original
mspiq/php2shell-scanner	50	13 of 13	lab	clear	original
nouralmashaek/detect_php2shell	50	12 of 12	static	clear	original
ramzieus/php2shell-checker-claude	50	12 of 12	static	clear	copy of adhie401 with changes
rickvkalker/php-risk-check	50	13 of 13	static	clear	original
ringozzt/security-incidents-research	50	12 of 12	static	clear	original
suraj00415/php2shell-detector-manually	50	12 of 12	static	clear	original
WallcroftUK/CVE-2026-109619	50	12 of 12	lab	clear	original
dszp/php-exposure-scan-cloudflare	49	13 of 13	static	clear	original
hugomn/heldkeys	49	14 of 14	static	caution	original
juxt-lang/juxt	49	14 of 14	static	clear	original
sprabhav7/php2shell-detection	49	13 of 13	static	clear	copy of jgatka with changes
tsepangnkoe/php2shell-audit	49	14 of 14	static	clear	original
AcelezXYZ/PHP2Shell-Checker	48	13 of 13	static	clear	original
actions-marketplace-validations/KyleClouthier_php2shell-action	48	14 of 14	static	clear	GitHub Marketplace mirror of KyleClouthier
AmpedWasTaken/PHP2Shell-CVE-2026-109618-CVE-2026-109619	48	13 of 13	static	clear	original
Greg-Boggs/Ithildin	48	12 of 12	static	caution	original
jeffreyesdavid/php-guardian	48	12 of 12	static	clear	original
Ls-ComCSIRT/php2shell-scan	48	13 of 13	static	clear	copy of D4RCKCYPH3R
rasyidprasetyo694-cell/php2shell-security-audit	48	13 of 13	static	clear	original
Revelution91/php2shell-recon	48	14 of 14	static	clear	original
rootabhi1/php2shell-triage	48	14 of 14	lab	clear	original
SoroushAlamdari/php2shell-detect	48	12 of 12	static	clear	original
umer-r/php2shell-scan-revamp	48	13 of 13	static	clear	reuses code from assetnote
0xrsydn/php2shell-scan	47	13 of 13	static	clear	original
ultravistor/int	47	12 of 12	static	caution	original
dib korma/black-october-check	46	12 of 12	static	caution	original
skorzan/elasticsearch_admin	46	14 of 14	static	caution	original
artifexignotvs/reliqua	45	14 of 14	static	caution	original
ChrishSec/PHP2Shell	45	13 of 13	static	caution	original
d0rb/ShellSCope	45	13 of 13	static	clear	original
inetzombie/php2shell-check	45	13 of 13	static	clear	original
sslab-repo/php-cve-scanner	45	13 of 13	static	clear	original
TahuCryptsi/php2shell-check	45	12 of 12	lab	clear	original
Tenor-Z/Phoundry	45	13 of 13	static	clear	original
dhje0ng/php2shell	44	13 of 13	static	clear	original
hebertcisco/php2shell_checker	44	14 of 14	static	clear	original
JackReaper1020/php_oom	44	13 of 13	static	clear	original
meta-l/WordPress-PHPVuln-Triage	44	12 of 12	static	clear	original
shashanksc/Black-October-PHP-Fallout-Patch-Check	44	12 of 12	static	clear	original
vartaktushar/php2shell-checker-poc	44	12 of 12	static	clear	original
Basilisk-bat/RPK-PHP2Shell-Triage	43	14 of 14	static	clear	original
benzeng/php-cve-2026-1096-research	43	12 of 12	lab	clear	original
Athexblackhat2/php2shell	42	12 of 12	lab	clear	original
actions-marketplace-validations/jondot_blastradius	41	14 of 14	static	caution	GitHub Marketplace mirror of jondot
AngeliqueDawnbringer/php2shell-detect-tools	40	12 of 12	static	clear	original
Cor0n4V1rus/php2shell-collector	40	12 of 12	static	clear	original
darryn9527/three-lenses	40	12 of 12	static	clear	original
kawataro0831-hash/makaseru-check-your-systems-202610	40	12 of 12	static	clear	original
mobarati-com/site-web	40	13 of 13	static	clear	original
reza-ghanbari-adivi/php2shell-scanner	40	13 of 13	static	clear	original
Erfanmghs/php2shell-scanner	39	13 of 13	static	clear	copy of assetnote with changes
devzyai/CVE-2026-109618-POC	34	12 of 12	static	clear	original
fardinbarashi/PHP-CVE-2026-109618-and-CVE-2026-109619	34	12 of 12	static	clear	original
yerlijoker/php2shell-recon	33	13 of 13	static	clear	original
3tternp/php2shell-scanner	30	13 of 13	static	clear	original
AIjennings/ariawave-metacognition	30	12 of 12	static	clear	original
focuslight-nr/php2shell-checker-extension	30	12 of 12	static	clear	original
intelliroot-tech/php2shell	30	12 of 12	static	clear	original
JumpsecLabs/phpocalypse	30	12 of 12	static	caution	original
ntfndOfficial/phpDetector	30	12 of 12	static	clear	original
retr0-m/isitphp	30	13 of 13	static	clear	original
s4turns/php2shell-scan	30	12 of 12	static	caution	original
swoodby/php2shell	30	12 of 12	static	clear	original
WhoTargetsMe/wtm-website	30	12 of 12	static	clear	includes files from DisruptiveStudioInc
Photon817/chainproof	24	13 of 13	static	clear	original
ashwnn/php2shell-honeypot	20	13 of 13	static	clear	original
davydovserg/PHP2shellbiz	20	13 of 13	static	clear	original
defendable/PHP2Shell	20	12 of 12	static	clear	original
EkaterinaMarchetti/Non-intrusive-PHP2Shell-assessment-for-CVE-2026-109618-and-CVE-2026-109619	20	12 of 12	static	clear	original
farimazhar/GitLab2Safe-Defensive-Checker	20	13 of 13	static	clear	original
fellipgomes/br-php2shell	20	12 of 12	lab	clear	original
hebertcisco/homebrew-php2shell-checker	20	12 of 12	static	clear	original
mohamedkyyann-web/darae-v2	20	12 of 12	static	clear	original
NullEmber/php-security-audit	20	12 of 12	static	clear	original
tape-runner/Modsecurity-php2shell	20	12 of 12	static	clear	original

Detection rules (59) (click to expand)

Repo	Score	Coverage	Tested	Safety	Origin
rjmendez/phpup-2026	90	12 of 12	static	clear	original
umbrasec-labs/umbrasec.dev	85	14 of 14	static	clear	original
corelight/php2shell-detect	81	12 of 12	static	clear	original
ionsec/php2shell-detector	80	12 of 12	static	clear	original
mikensec/php2shell-lab	80	12 of 12	static	clear	original
initconf/php-rce-2026-10-21	77	11 of 11	static	clear	original
break-the-build/php-multipart-waf-signals	75	12 of 12	static	caution	original
CypherSecurity/php2shell-detection	75	12 of 12	static	caution	original
LeminEly/CVE-2026-109618-109619	75	13 of 13	static	clear	original
orbitron-ai/php2shell-response-kit	73	12 of 12	static	clear	original
xC0D3F4TH3R/PHP2SHELL-DEFENSIVE-KIT	73	14 of 14	static	clear	original
Lexsah/php2shell-detection	72	12 of 12	static	clear	original
violensoul/php2shell-sigma	70	12 of 12	static	clear	original
slabwren/php2shell-detection (deleted)	68	9 of 11	static	clear	original
secamin/detection-engineering	66	13 of 13	static	clear	original
darkfibr/php2shell-detect	65	12 of 12	static	clear	original
SumonMSelim/skills	62	11 of 11	static	clear	original
BartoszGarba/php2shell-sigma-rules	60	12 of 12	static	clear	original
elmajouli-yassine/php2shell_Vuln_lab	60	11 of 11	static	clear	original
euriconicacio/php2shell-validation-toolkit	60	11 of 11	static	clear	original
gsehnen/modsecurity	60	11 of 11	static	clear	original
scadastrangelove/php2shell	60	12 of 12	static	clear	original
stinky-kombucha-labs/cve-exposure-monitor	59	14 of 14	static	clear	original
Aur3ns/php2shell-defense	58	13 of 13	static	clear	original
dc-holdings-spa/php2shell-research	56	12 of 12	static	clear	original
cred0core/Sigma-rule-CVE-2026-109618	55	12 of 12	static	clear	original
PasqualePillitteri/php2shell-hardening	54	11 of 11	static	clear	shares files with eness (order unclear)
0xAllow/PHP2Shell-Defense	53	13 of 13	static	clear	original
yetDevs/php2shell-triage	53	12 of 12	static	caution	original
mym0us3r/PHP2Shell-Detection-with-Wazuh	52	11 of 11	static	clear	original
Aminesikz/threathunt-lab	50	13 of 13	static	clear	original
DetectionFlow/threat-research	50	12 of 12	static	clear	original
ebenhaezer19/php2shell-lab	48	12 of 12	static	clear	original
d0gban/php2shell-poc	47	11 of 11	static	caution	original
aplite-de/php2shell-detection-rules	20	11 of 11	static	clear	original
Autive/php2shell-watch	20	11 of 11	static	clear	original
bashclub/php2shell-forensic-check	20	11 of 11	static	clear	original
BenFerguson310/Cloudflare-PHP2shell-Detections	20	11 of 11	static	clear	original
Blue-B/php2shell-guard	20	11 of 11	static	clear	original
CharlesCorreaDev/DockerPHP-by-CharlesCorrea	20	11 of 11	static	caution	original
Cyber-BansalAI/php2shell-2026	20	11 of 11	static	clear	original
deathbydata/php2shell-exposurehunt	20	12 of 12	static	clear	original
dipsh0v/php2shell-emudhra-hunting	20	11 of 11	static	clear	original
E-Sherlock/php2shell-detection-engineering-lab	20	12 of 12	static	clear	original
gkwelding/php2shell-ioc-check	20	12 of 12	static	clear	original
goodelyfe/php-node-runtime-check	20	12 of 12	static	clear	original
gutterwall/sentinel-shield	20	13 of 13	static	caution	original
iSecNG/php2shell-honeypot	20	12 of 12	static	caution	original
joealjohn/PHP2SHELL-Sentinel-	20	13 of 13	static	clear	original
ledahu/PHP-Multipart-Guard	20	12 of 12	static	clear	original
litobro/php2mon	20	13 of 13	static	clear	origi nal
ManOnFire40/Detection-Rules	20	11 of 11	static	clear	original
nexaforge-oss/wazuh-ruleguard	20	13 of 13	static	clear	original
ninjapaw/php2shell-cloud-defense-dojo	20	13 of 13	static	clear	original
Opathedane/php2shell	20	12 of 12	static	caution	original
pt0x/MS-Sentinel-Releases	20	11 of 11	static	clear	original
rootone-it/nginx-php2shell-monitor	20	11 of 11	static	clear	original
Shadow-Pixxxel/php-advanced-hunting	20	11 of 11	static	clear	original
Tichod/PHP2ShellThreatHunting	20	11 of 11	static	clear	original

Docs (75) (click to expand)

< td>85

Repo	Score	Coverage	Tested	Safety	Origin
Akirapl/php2shell	95	14 of 14	static	clear	original
NCSC-NL/php2shell	91	13 of 13	static	clear	original
NaNoBotCo/php-patch	88	13 of 13	static	clear	original
xenako0012/JugueteoFonsi	88	14 of 14	static	clear	original
LightSpeedC/20261022-research-php-cve	87	13 of 13	static	clear	original
0nyxra/php2shell-homelab	85	13 of 13	static	clear	original
0xDTC/0xPHP2SHELL-Impact-Analysis	85	13 of 13	static	clear	original
absholi7ly/Deep-Technical-Report-CVE-2026-109618-CVE-2026-109619-PHP2Shell	85	13 of 13	static	clear	original
aidevksh/php2shell-report	85	13 of 13	static	clear	original
ansonhsu-ai/php2shell-cve-2026-109618-ste	85	13 of 13	static	clear	original
AvaterXXX/CVE-2026-109618-CVE-2026-109619-	85	13 of 13	static	clear	original
BIG02-bot/PHP2Shell-Technical-Security-Analysis	85	13 of 13	static	clear	original
bvboe/php2shell-php5-remediation-analysis	85	13 of 13	static	clear	original
CyberSunil/cybersunil.github.io	85	13 of 13	static	clear	original
HGraphPunks/ai-response-kit	85	13 of 13	static	clear	original
hkoeck/php2shell-status	85	13 of 13	static	clear	original
KadkinRoman/php84-migration-report	85	13 of 13	static	clear	original
mekhalleh/php2shell-advisory	85	13 of 13	static	clear	original
MKA930/php2shell-remediation-guide (deleted)	85	10 of 12	static	clear	original
mrdevs1/php-critical-vulnerability-patching-guide-2026	85	13 of 13	static	clear	original
nwfella/php2shell-advisory	85	13 of 13	static	clear	original
pete-builds/php-security-release-2026-10	85	13 of 13	static	clear	original
pipi356/temp-rep	85	13 of 13	static	clear	original
sdminev/php2shell-poc	13 of 13	static	clear	original
seaworld008/php-fpm-nginx-images	85	14 of 14	static	caution	original
tanujprajapati/php2shell	85	13 of 13	static	clear	original
TH3-ART-F0R-CR4CK1N6/vulnerabilidad-PHP	85	13 of 13	static	clear	original
wassim191/TryHackme-walkthroughs	85	13 of 13	static	clear	original
wind884/CVE-2026-109618-109619-PHP2Shell	85	13 of 13	static	clear	original
Cqsi/php2shell-atlas	83	15 of 15	static	clear	original
meowmeow34spec/php2shell-namu-kr	83	13 of 13	static	clear	original
rajasekharponakala/php2shell-brief	83	14 of 14	static	clear	original
techtaek77/php2shell-guide	83	13 of 13	static	clear	original
dos-security/php-critical-rce-advisory	80	13 of 13	static	clear	original
r0x43g/php2shell-vendor-watch	80	13 of 13	static	clear	original
Ridd1kulusC0d3r/Wazuh	79	13 of 13	static	clear	copy of mym0us3r with changes
JoshRob297/php2shell-research	78	13 of 13	static	clear	original
PolymathWizard/BHIL-NSA-PHP-Impact-Radius	78	13 of 13	static	caution	original
Nayrae/CVE-2026-109618	77	13 of 13	static	clear	original
solymx/php-cve-2026-research	77	13 of 13	static	caution	original
cras974/-PHP2Shell-Educational	75	13 of 13	static	clear	original
MehdiBouchgua/labo-php2shell	75	13 of 13	static	clear	original
silastammerik/php2shell-mitigacao	75	13 of 13	static	clear	original
tmcadams/Citrix-ADC-responder-policies-for-PHP2Shell	75	13 of 13	static	clear	original
lushinshang/php2shell-cve-2026-109618	73	13 of 13	static	clear	original
veereshkumarkolli-WE/php-update-agent-211026	73	13 of 13	static	clear	original
ChaseCoble/security_case_studies	65	13 of 13	static	clear	original
exch0-wuz-h3r3/php2shell-response-inspector	65	13 of 13	static	clear	original
Tosborne94/php2shell-IoCs	65	13 of 13	static	clear	original
wa qas578/Plymouth-Retail-Ltd.—PHP2Shell-Vulnerability-Incident-Remediation-Report	65	13 of 13	static	clear	original
GooGKush/docs	63	13 of 13	static	clear	original
tonnoy-maker/php-vulnerability-awareness-sim	63	13 of 13	static	clear	original
0-draft/php2shell-anatomy	59	15 of 15	static	clear	original
Filipegabri/RodMapAuditoriaweb	55	13 of 13	static	clear	original
jenishs524/PHP-Security-Research	53	13 of 13	static	clear	original
baron-stybd/CVE-2026-109618-CVE-2026-109619	50	13 of 13	static	caution	copy of NCSC-NL with changes
IamSaishi/PHP2Shell-Nuclei-Detection-Template	50	13 of 13	static	clear	original
ssh-pw/sury-php-arm64-emergency-build	50	13 of 13	static	clear	original
0ldbaby/php2shell	40	13 of 13	static	clear	original
87sunitasingh-droid/RHYTHM-SINGH	40	13 of 13	static	clear	original
aliasec/Php2Shell	40	13 of 13	static	clear	original
ChaskarVinit/cve-2026-109618-php-oom-simulation	40	13 of 13	static	clear	original
haobachang-1/php2shell-CVE-2026-109618-CVE-2026-109619	40	13 of 13	static	clear	original
otoinobuo/otoinobuo	40	13 of 13	static	clear	original
PukPukov/pwrap	40	13 of 13	static	clear	original
koshikraj/amiaffected	39	13 of 13	static	caution	original
cyeezy08/security-research-portfolio	20	13 of 13	static	clear	original
dseguy/SIG-marketing-php2shell	20	13 of 13	static	clear	original
g41277460-cpu/CVE-2026-109618-CVE-2026-109619-php2shell-	20	13 of 13	static	clear	original
gayathrisenthilvel29-wq/whitehats_club_application	20	13 of 13	static	clear	original
imj0b/php2shellipattacked	20	13 of 13	static	clear	original
jerryyay/PHP2SHELLtest	20	13 of 13	static	clear	original
l3kshmanr/php2shell-bypass-aslr-exp	20	13 of 13	static	clear	original
MarsInnovations/php2shell	20	13 of 13	static	clear	original
nikip72/php2shell-offsets	20	13 of 13	static	clear	original

Other (109) (click to expand)

13 of 13

Repo	Score	Coverage	Tested	Safety	Origin
allixsenos/phpocalypse-tracker	92	13 of 13	static	clear	original
grayishsun/disable-session-upload-progress	90	13 of 13	static	clear	original
WaldemarEnns/2shell-data	90	15 of 15	static	clear	original
UmarAlMukhtar/php2shell-live	89	15 of 15	static	clear	original
blacklanternsecurity/PoCs	88	13 of 13	static	clear	original
ExaForce/ExaPHP2Shell	88	13 of 13	static	clear	original
barnabas-szekeres/forge-php-74	87	13 of 13	static	clear	original
17vivekupadhyay/php2shell	85	14 of 14	static	clear	original
CyberSunil/php2shell	85	13 of 13	static	clear	original
ehb54/php_site_watch	85	14 of 14	static	caution	original
jamieduk/PHP2SHELL-MSF-MODULE	85	13 of 13	static	clear	original
karlisl/php2shell-rules	85	13 of 13	static	clear	original
lufeirider/php2shell	85	13 of 13	static	clear	original
Masriyan/php2shell	85	13 of 13	static	clear	original
mosadiq22/PHP2Shell-TryHackMe-Walkthrough	85	13 of 13	static	clear	original
nikhilyadav551/php2shel	85	13 of 13	static	clear	original
ojgarciab/2026-10-21-php-vulnerable	85	15 of 15	static	clear	original
olizimmermann/php2shell-nuclei-template	85	13 of 13	static	clear	original
scriptzteam/Paranoid-PHP2Shell	85	13 of 13	static	clear	original
utkarsssh17/cve-2026-109618-php2shell-poc	85	13 of 13	static	clear	original
utkarsssh17/cve-2026-109619-php-uaf-poc	85	13 of 13	static	clear	original
VikasChahalLover/php2shell.in	85	13 of 13	static	clear	original
xynatez/PHP2Shell-lms	85	13 of 13	static	clear	original
yancey918/php2shell_threat_hunter	85	13 of 13	static	clear	original
Z4LT1/informes-app	85	13 of 13	static	clear	original
geovanidps/PHP2Shell-Playbook-SOC	83	13 of 13	static	caution	original
izdir/php-security-patcher	83	13 of 13	static	clear	original
mysukriramli/php-exposure-radar	83	15 of 15	static	clear	original
stevehenderson/php2shell-pcaps	83	13 of 13	static	caution	original
allanloplus/CASE	81	14 of 14	static	clear	original
Belkouche/aslan-payment-laravel	80	14 of 14	static	clear	original
JACOBIAN01/decoded	80	14 of 14	static	clear	original
lo3elyon/ASI	80	13 of 13	static	clear	original
serejaris/php2shell	80	13 of 13	static	clear	original
z3vok/cve-lab	80	13 of 13	static	clear	original
logesh-GIT001/php2shell	79	13 of 13	static	clear	copy of assetnote with changes
hidetzu/vulnograph	78	14 of 14	static	clear	original
svengong/vuln-repro-agent	78	15 of 15	static	clear	original
42tahara/php-shindan	75	13 of 13	static	clear	original
baph00met/php2shell-stock_php-wp-roundcube-drupal	75	13 of 13	static	clear	original
hanmary82/php2shell-observatory	75	13 of 13	static	clear	original
imbas007/nuclei_php2shell_template	75	13 of 13	static	clear	original
jwood1985/php2shell	75	13 of 13	static	clear	original
vyaktigat1326/scs-php2shell-dev-run	75	13 of 13	static	clear	original
vyaktigat1326/scs-php2shell-dev-run-cc	75	13 of 13	static	clear	original
wujiit/qilinggeo	75	13 of 13	static	clear	original
php2-shell/php2shell-POC-CVE-2026-109618-CVE-2026-109619	73	13 of 13	static	caution	original
zenworksza/php-cve	73	13 of 13	static	clear	original
pagvac/php2shell-trends	72	13 of 13	static	clear	original
AdapptOnAzure/app-service-status	70	14 of 14	static	clear	original
canhnm/php2shell-hunt	70	13 of 13	static	clear	original
explainbrew/prompts	70	13 of 13	static	clear	original
hadayalab-web/pandemic -fortress-advisories	70	13 of 13	static	clear	original
komanbe/php-crisis-30-days	69	15 of 15	static	clear	original
Gi1gamesh123/php-unserialize-uaf-rce	68	13 of 13	static	clear	original
grupooruss/php2shell-test	68	13 of 13	static	clear	original
jondot/blastradius	68	15 of 15	static	caution	original
jtylek/PHP-windows-devstack	67	14 of 14	static	caution	original
Topogamer0/failstep	66	14 of 14	static	caution	original
andretasty/unitedweb-site	65	13 of 13	static	clear	original
cyberkiddle/CVE-2026-109618	65	13 of 13	static	clear	original
goodcoddeo/pterodactyl_PHP-CVE-2026-109618-CVE-2026-109619	65	13 of 13	static	clear	original
itzen300/php2shell_RCE	65	13 of 13	static	clear	original
ivanalexo/bolivia-php-vuln-analisys	65	13 of 13	static	clear	original
RitionLin/php2shellpath	65	13 of 13	static	clear	original
saurabhthesuperhero/codersaurabh	65	13 of 13	static	clear	original
sc3p73r-it/php-playbook	65	13 of 13	static	clear	original
susanst-dt/php2shell	65	13 of 13	static	clear	original
ThiagoRocha05/paitechbr-guias	65	13 of 13	static	clear	original
cagritopuz/php2shell	62	13 of 13	static	caution	original
SaranaTechnology/sarana-php	62	15 of 15	static	clear	original
AGI-CEO/awesome-money-making-mcp-servers	60	13 of 13	static	clear	original
CyberThreatNet/hunt-lab	60	14 of 14	static	clear	original
daffa001/php-CVE-2026-109618-CVE-2026-109619	60	13 of 13	static	caution	original
joser14/joser14	60	13 of 13	static	clear	original
mdm-delo/php-update-landing	60	13 of 13	static	clear	original
GambitMutant/aegis-pinterest-for-woocommerce-conditions	58	13 of 13	static	caution	original
LSG-PolarBear/PHP2Shell	58	13 of 13	static	caution	original
phpeek-ext/phpeek	57	13 of 13	static	caution	original
Serzhun-crypto/nophp2shellbackport	53	static	caution	original
EnkiHQ/break-anything	48	15 of 15	static	clear	original
Synctank-jp/jp-data-breach-2026	48	14 of 14	static	clear	original
weskongxing/astrbot_plugin_cve_push	45	14 of 14	static	clear	original
AGI-CEO/php2shell-wordpress-to-nextjs-mcp	43	15 of 15	static	clear	original
BjWe/mod_php_dummy	43	14 of 14	static	caution	original
jarohull-ai/jfp-edge-radar	42	15 of 15	static	caution	original
Adarsh-Shetkar/legacyshield	40	14 of 14	static	clear	original
AIjennings/AIjennings	40	13 of 13	static	clear	original
fatima-zahra-hub/php2shell-memory-leak.	40	13 of 13	static	clear	original
mhh12122010-code/CVE-Watch	40	14 of 14	static	clear	original
syrex1013/CVE-2026-109618	40	13 of 13	static	clear	original
syrex1013/CVE-2026-109619	40	13 of 13	static	clear	original
Julien-TrentAI/php2shell-trent-fixture	38	14 of 14	static	clear	original
Ron-L/XamppStack	38	13 of 13	static	clear	original
therealsylva/rift-	38	15 of 15	static	clear	original
AhmedAA/k3s-moodle	37	14 of 14	static	caution	original
Klodi666/php2shell	30	13 of 13	static	clear	original
Aceop-001/lilis-kitchen	20	13 of 13	static	caution	original
anywaye/nilepatch-safe-app	20	13 of 13	static	clear	original
DefectDojo/homebrew-tap	20	13 of 13	static	clear	original
Durrell-229/Php2shell-v.01	20	13 of 13	static	caution	original
fabwebbr/scripts	20	13 of 13	static	clear	original
Filipegabri/Wazuh-enterprise-baseline-2026	20	13 of 13	static	clear	original
fortinet-fortisoar/solution-pack-outbreak-response-php2shell-remote-code-execution-vulnerabilities	20	13 of 13	static	clear	original
Mikweb2025-design/Mikweb2025-design	20	14 of 14	static	clear	original
oldnco/php2shell-Kontrolle	20	13 of 13	static	clear	original
pescobarayats-lab/php2shellbby	20	13 of 13	static	clear	original
rafeuddaraj/orderdesk-php-demo	20	13 of 13	static	clear	original
studioibizz/placeholder-php2shell	20	13 of 13	static	clear	original