PHP2Shell Scanner
This check uses Assetnote's open-source php2shell-scanner package.
It sends a small control request and up to three active multipart probes totaling about 29 MiB. A vulnerable result should be confirmed against the installed PHP version and vendor backports.
Warning: Only run this against sites you are authorized to probe. We are logging targets, requesting IPs and browser fingerprints.
How to act on the result
A positive signal means you should verify the PHP runtime directly and patch it immediately. A clean or inconclusive remote scan does not prove that a hidden or vendor-patched PHP installation is safe.
This service blocks private and reserved network addresses, does not follow redirects, accepts one target per scan, and limits each requesting IP to three scans per hour.