aulwardana

Php2shell Check — Security skill for Claude Code

Security community

A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version where possible, and flags exposure to PHP2Shell (CVE-2026-109618 / CVE-2026-109619.

How to install Php2shell Check

This entry records only its repository, not the path inside it, so there is no exact command to give. Open aulwardana/php2shell-check and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Php2shell Check does

Alternatives in Security

Data Viz Audit — Audit a data visualization for chart type selection, accessible color palette, annotations, and anti-patterns 309 ★
Spec Check — Audit GWT acceptance test specs for implementation leakage 149 ★
Compat Audit — On-demand Claude Code compatibility and feature parity report — compares installed version against the breakpo 117 ★

README

PHP2Shell Check — Claude Skill

A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version where possible, and flags exposure to **PHP2Shell** (CVE-2026-109618 / CVE-2026-109619) — using only ordinary, non-intrusive HTTP requests. No exploitation, no malformed input, no port scanning, no fuzzing.

Works inside Claude conversations (Claude.ai, Claude Code, Cowork) once installed — just ask in plain language, e.g. *"check example.com for PHP2Shell exposure"*.

**This is a defensive/awareness tool, not an exploit.** It compares version strings against official patch data — it never attempts to trigger or confirm the underlying vulnerability. See [Scope & limitations](#scope--limitations) and [Ethics & authorization](#️-ethics--authorization--read-before-scanning-anything-you-dont-own) before pointing it at anything you don't own.

What it checks

Each signal is weighted and combined into a scored verdict (`high` / `medium` / `low` / `inconclusive`) rather than trusting any single header:

Layer	Signal	Weight
Headers	`X-Powered-By: PHP/x.y.z`, `Server:` banner	Strong
Cookies	`PHPSESSID` present	Strong
Common paths	`wp-login.php`, `administrator/index.php`, etc. resolve to `.php`	Moderate
Markup	for WordPress/Joomla/Drupal/MediaWiki	Moderate
Markup	`.php` form action attributes	Weak

Optionally extends the same checks to subdomains, discovered passively via:

Certificate Transparency logs (crt.sh) — queries a public cert log, never touches the target
DNS resolution of a built-in wordlist (mail, webmail, sso, portal, owa, autodiscover, admin, vpn, helpdesk, etc.) — a DNS lookup doesn't contact the target's server
A manual list you supply yourself