Hi All. A coworker and I (and AI) built this python script that checks HTTP response headers for indicators that the site is using a version of PHP that's vulnerable to PHP2Shell (CVE-2026-109618, CVE-2026-109619). It's an asynchronous HTTP/HTTPS header inspection tool that fingerprints PHP and compares the version against the PHP2Shell fixed releases. Obviously this isn't a foolproof way of knowing if a host is vulnerable (See Security disclaimer in README.md), but it's at least good at finding hosts in your environment that are advertising to the internet that they are using a vulnerable version of PHP.

My first time submitting to HN - please be merciful. Now accepting feedback, suggestions, and constructive criticism.