If you find a security issue in php2shell-scan itself, please report it privately instead of opening a public issue:

• Email: cumakurt@gmail.com
• Or open a private security advisory on GitHub: https://github.com/cumakurt/php2shell-scan/security/advisories/new

Please include:

• the affected version (php2shell-scan --version),
• your operating system and Go version if you built from source,
• a description of the issue and its impact,
• reproduction steps or a proof of concept,
• whether either tracked CVE (CVE-2026-109618 / CVE-2026-109619) is involved.

You can expect an acknowledgement within 7 days and a remediation plan within 30 days. Credit will be given in the release notes unless you ask otherwise.

In scope:

• the Go scanner in new/ (CLI, HTTP client, fingerprinting, PoC logic),
• new/install.sh,
• report generation (JSON, text, SARIF, baseline).

Out of scope:

• the legacy Python toolkit in the repository root (php2shell.py),
• findings produced about a scanned target — those belong to that target's owner, not to this project,
• the tracked PHP vulnerabilities themselves. Report those to the PHP project.

php2shell-scan is deliberately limited. Any behaviour outside this list should be treated as a security defect, not a feature:

• read-only HTTP requests (GET, HEAD, OPTIONS, and form-encoded POST carrying only a fixed read-only command),
• four fixed commands: uname -a, id, whoami, hostname,
• no file uploads, no writes, no shells, no listeners, no persistence,
• no operator-supplied command strings,
• no execution of memory-corruption or OOM payloads.

The tool does not enforce authorization; the operator is responsible. Running it against systems you do not own or lack written permission to test may be illegal. See the "Legal use" section of the README.

This project is licensed under the GNU General Public License v3.0 or later. See LICENSE.