phpscan 1.4.4__py3-none-any.whl

phpscan/__init__.py

@@ -0,0 +1,15 @@
+"""phpscan — the free, open-source external PHP scanner from
+PHP Patch Assurance (https://phpatch.com).
+
+Passive fingerprinting plus limited, read-only checks of a few
+well-known paths (the phpinfo exposure probes): it reads what a
+site already discloses publicly (headers, generator tags, exposed
+phpinfo pages) and judges any disclosed PHP version against the
+advisory database in data/cves.json. It never runs exploit probes.
+
+When a site hides its PHP version — most well-run sites do — the
+verdict is an honest INDETERMINATE, with the path to a certain
+answer (a read-only server check) explained at https://phpatch.com.
+"""
+
+__version__ = "1.4.4"

phpscan/__main__.py

@@ -0,0 +1,52 @@
+"""CLI: python3 -m phpscan <url> [more urls...]
+
+Prints one JSON verdict object per URL.
+
+Exit codes: 0 — scanned, no actionable finding; 1 — at least one
+target is vulnerable, possibly vulnerable, or on an end-of-life
+branch; 2 — usage error, or a target could not be judged at all:
+unreachable, or `not_assessed` (its PHP branch is newer than the
+advisory database, so the scanner cannot judge it). When several
+targets are scanned, the worst code wins.
+"""
+
+import json
+import sys
+
+from .scan import scan
+
+_ACTIONABLE = ("vulnerable", "possibly_vulnerable", "eol")
+_UNJUDGED = ("not_assessed", "unreachable")
+
+
+def main(argv):
+    argv = [a for a in argv if a != ""]
+    if not argv:
+        print(__doc__)
+        return 2
+    if any(a in ("-h", "--help") for a in argv):
+        print(__doc__)
+        return 0
+    worst = 0
+    for url in argv:
+        try:
+            r = scan(url)
+            print(json.dumps(r, indent=1))
+            status = (r.get("verdict") or {}).get("status")
+            if status in _ACTIONABLE:
+                worst = max(worst, 1)
+            elif status in _UNJUDGED:
+                worst = max(worst, 2)
+        except Exception as e:  # one bad target must not kill the run
+            print(json.dumps({"url": url, "error": str(e)}))
+            worst = max(worst, 2)
+    return worst
+
+
+def cli():
+    """Console-script entry point (the `phpscan` command)."""
+    return main(sys.argv[1:])
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

phpscan/data/cves.json

@@ -0,0 +1 @@
+{"advisories":[{"affected_sapis":["apache2handler (mod_php)","php-fpm","php-cgi","frankenphp","litespeed"],"cves":["CVE-2026-109618","CVE-2026-109619"],"cvss_v4":9.2,"distro_note":"Distribution packages may backport the fix without changing the upstream version string — verify via the package changelog or distro advisory, not the version alone. Third-party repositories lagged the fix on release day (Remi had no fixed build on 2026-10-21): when the repo has no fixed package, use the official container image or a source build, or apply the interim mitigations.","eol_below":"8.2","eol_note":"Branches below 8.2 receive no security fixes from the PHP project. There is NO patched release for them: the only remedies are a branch upgrade or taking the site offline (CERT-EU).","fixed_releases":{"8.2":"8.2.35","8.3":"8.3.36","8.4":"8.4.27","8.5":"8.5.12"},"id":"php2shell-2026-10","interim_mitigations":["Restrict access to the site (IP allow-list at the proxy / CDN) until patched — reduces exposure; it is not a fix","Enforce request-size limits at the reverse proxy / CDN edge as defense-in-depth","If no patched release can be deployed, take the site offline (CERT-EU guidance for unpatchable sites)"],"published":"2026-10-21","references":["https://www.php.net/releases/", "https://cert.europa.eu/publications/security-advisories/2026-018/", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "https://www.cve.org/CVERecord?id=CVE-2026-109618", "https://www.cve.org/CVERecord?id=CVE-2026-109619"],"summary":"Two critical flaws in PHP core: CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state). Both are exploitable over the network with no authentication. Any PHP application on a vulnerable build is exposed, regardless of the application itself.","timeline":"Vulnerability details leaked 2026-10-20. Fixed releases published 2026-10-21 (14:00 UTC). Exploitation was observed in the wild from 2026-10-21 07:43 UTC (Cloudflare data, reported by Sansec) — the exposure window opens at the leak, not at the patch.","title":"php2shell — unauthenticated remote code execution in PHP core"}],"source_notes":"Fixed releases published by the PHP project on 2026-10-21 (~14:00 UTC). CERT-EU advisory 2026-018, a CISA alert and an FBI alert circulated the same day; CERT-EU advised operators who cannot patch to take affected sites offline.","updated":"2026-10-22"}

phpscan/scan.py

@@ -0,0 +1,467 @@
+"""Step 1a — external scan (no credentials).
+
+Fingerprints PHP from what a site discloses over HTTP: X-Powered-By /
+Server headers, PHPSESSID cookies, CMS generator signals, and exposed
+phpinfo pages. An exact version, when disclosed, is checked against the
+patched-release floors.
+
+Honest limit: most well-run sites suppress version headers. For those the
+scan reports "PHP detected, version hidden — patch status cannot be
+confirmed from outside" and recommends the credentialed deep check.
+"""
+
+import http.client
+import ipaddress
+import re
+import socket
+import ssl
+import threading
+import time
+import urllib.parse
+
+from . import versioning
+
+_UA = "phpscan/1.4.4 (+https://phpatch.com/security)"
+_TIMEOUT = 12
+_MAX_BODY = 512 * 1024
+_MAX_REDIRECTS = 5
+_PHPINFO_PATHS = ("/phpinfo.php", "/info.php", "/php-info.php", "/test.php")
+
+
+class BlockedTarget(Exception):
+    """Target refused by the scanner's SSRF/abuse policy."""
+
+
+# Ranges that Python's is_global / is_private flags do not classify
+# consistently across versions, checked explicitly: carrier-grade
+# NAT (includes cloud metadata endpoints in that space), the IETF
+# special-purpose /24, benchmarking space, the deprecated 6to4
+# relay anycast, and the IPv6 transition prefixes whose embedded
+# IPv4 destination could be non-public (NAT64 well-known prefix,
+# Teredo).
+_EXTRA_BLOCKED = [ipaddress.ip_network(n) for n in (
+    "100.64.0.0/10", "192.0.0.0/24", "198.18.0.0/15",
+    "192.88.99.0/24", "64:ff9b::/96", "2001::/32")]
+
+
+def _blocked(ip):
+    """True unless the address is globally routable public space.
+
+    Primary test is is_global (negated): it covers loopback,
+    RFC1918, link-local (incl. cloud metadata 169.254.169.254),
+    CGNAT, reserved and unspecified space across Python versions,
+    which the individual is_private-style flags do not.
+    """
+    return (not ip.is_global or ip.is_multicast
+            or any(ip in n for n in _EXTRA_BLOCKED))
+
+
+def _public_ips(host):
+    """Resolve a host and require EVERY answer to be a public IP.
+
+    Blocks loopback, private, link-local (incl. cloud metadata
+    169.254.169.254), reserved, multicast and unspecified addresses,
+    so the public scanner can never be pointed at internal services.
+    """
+    try:
+        infos = socket.getaddrinfo(host, None,
+                                     proto=socket.IPPROTO_TCP)
+    except socket.gaierror as e:
+        raise BlockedTarget(f"DNS lookup failed for {host}: {e}")
+    ips = []
+    for info in infos:
+        ip = ipaddress.ip_address(info[4][0])
+        # Unwrap transition forms: the real TCP destination of an
+        # IPv4-mapped (::ffff:a.b.c.d) or 6to4 (2002:xxxx::) address
+        # is the embedded IPv4, so THAT is what must be checked —
+        # the IPv6 spelling alone does not trip the IPv4 ranges.
+        if isinstance(ip, ipaddress.IPv6Address):
+            if ip.ipv4_mapped is not None:
+                ip = ip.ipv4_mapped
+            elif ip.sixtofour is not None:
+                ip = ip.sixtofour
+        if _blocked(ip):
+            raise BlockedTarget(
+                f"{host} resolves to a non-public address; "
+                "the scanner only fetches public websites")
+        if str(ip) not in ips:
+            ips.append(str(ip))
+    if not ips:
+        raise BlockedTarget(f"DNS lookup returned nothing for {host}")
+    return ips
+
+
+class _PinnedHTTPS(http.client.HTTPSConnection):
+    """HTTPS to a pinned IP, with SNI + certificate checks against
+    the original hostname (defeats DNS-rebinding between the policy
+    check and the connect)."""
+
+    def __init__(self, ip, port, sni_host, timeout):
+        super().__init__(ip, port, timeout=timeout,
+                         context=ssl.create_default_context())
+        self._sni_host = sni_host
+
+    def connect(self):
+        http.client.HTTPConnection.connect(self)
+        self.sock = self._context.wrap_socket(
+            self.sock, server_hostname=self._sni_host)
+
+
+def _literal_refusal(host):
+    """Refuse non-standard IP encodings: decimal (2130706433), hex
+    (0x7f000001), octal parts (0177.0.0.1), short forms (127.1).
+    Resolver libraries disagree on these spellings, so they never
+    reach a resolver at all."""
+    if re.fullmatch(r"0[xX][0-9a-fA-F]+", host):
+        return "hex-encoded IP addresses are refused"
+    if re.fullmatch(r"[0-9.]+", host):
+        parts = host.split(".")
+        if len(parts) != 4 or any(
+                not p.isdigit() or int(p) > 255 or
+                (len(p) > 1 and p.startswith("0")) for p in parts):
+            return "non-standard IP address forms are refused"
+    return None
+
+
+def _preflight(url):
+    """Validate one fetch target. Called for the initial URL and
+    for EVERY redirect hop, so a redirect cannot smuggle in a
+    blocked scheme, port, credential or encoded address.
+    Returns (error, parts, port); error is None when clean."""
+    parts = urllib.parse.urlsplit(url)
+    if parts.scheme not in ("http", "https"):
+        return "only http/https URLs are scanned", None, None
+    if parts.username or parts.password:
+        return "URLs with credentials are refused", None, None
+    host = parts.hostname
+    if not host:
+        return "URL has no host", None, None
+    refusal = _literal_refusal(host)
+    if refusal:
+        return refusal, None, None
+    try:
+        port = parts.port or (443 if parts.scheme == "https" else 80)
+    except ValueError:
+        port = -1
+    if port not in (80, 443):
+        return "only ports 80 and 443 are scanned", None, None
+    return None, parts, port
+
+
+_DEADLINE = 25  # total seconds allowed for one response body
+_TOTAL_DEADLINE = 40  # total seconds for one whole SCAN: the
+# homepage fetch and every probe share this single budget
+
+
+def _kill_conn(conn):
+    """Watchdog action at the total deadline: shut the socket down
+    so any blocked read (header or body) fails at once. A per-read
+    socket timeout alone cannot bound a slow drip — every byte
+    that arrives inside the timeout re-arms the wait — so the
+    deadline is enforced by killing the connection, not by hoping
+    the reads notice the clock."""
+    try:
+        sock = getattr(conn, "sock", None)
+        if sock is not None:
+            try:
+                sock.shutdown(socket.SHUT_RDWR)
+            except Exception:
+                pass
+            try:
+                sock.close()
+            except Exception:
+                pass
+    except Exception:
+        pass
+
+
+def _read_capped(resp, budget=None, sock=None):
+    """Read a response body up to _MAX_BODY bytes under a TOTAL
+    deadline, so a slow-drip server cannot hold the scanner open
+    one byte at a time under the per-read socket timeout. The cap
+    applies to the raw bytes as received; the scanner never
+    decompresses, so a compressed bomb never expands. `budget`
+    (seconds remaining in the fetch's total deadline) can only
+    shorten the read, never extend it past _DEADLINE. When `sock`
+    is given, its timeout is recomputed from the remaining budget
+    before every chunk read, so no single read can wait past the
+    deadline either."""
+    chunks, got = [], 0
+    secs = _DEADLINE if budget is None else min(_DEADLINE, budget)
+    end = time.monotonic() + secs
+    while got <= _MAX_BODY:
+        remaining = end - time.monotonic()
+        if remaining <= 0:
+            break
+        if sock is not None:
+            try:
+                sock.settimeout(max(0.1, min(_TIMEOUT, remaining)))
+            except Exception:
+                pass
+        try:
+            chunk = resp.read(min(65536, _MAX_BODY + 1 - got))
+        except http.client.IncompleteRead as e:
+            # Server/proxy closed mid-body (common behind CDNs);
+            # the partial body is still a successful fetch.
+            if e.partial:
+                chunks.append(e.partial)
+            break
+        if not chunk:
+            break
+        chunks.append(chunk)
+        got += len(chunk)
+    return b"".join(chunks)[:_MAX_BODY]
+
+
+def _headers_dict(resp):
+    """Response headers as a dict, merging duplicates (notably
+    Set-Cookie) instead of letting dict() keep only the last one —
+    a PHPSESSID on an earlier Set-Cookie line must still be seen."""
+    out = {}
+    for k, v in resp.getheaders():
+        out[k] = f"{out[k]}, {v}" if k in out else v
+    return out
+
+
+def _fetch(url, ctx=None, deadline=None):
+    """Guarded fetch: http/https only, ports 80/443 only, no URL
+    credentials, every redirect hop re-validated and IP-pinned,
+    body capped, and a TOTAL deadline across connect + headers +
+    body + all hops, so a slow-drip server cannot hold a worker
+    open. `deadline` (a time.monotonic() timestamp) lets the
+    caller share ONE budget across a whole scan — homepage plus
+    all probes — instead of granting each fetch its own; without
+    it, the fetch gets _TOTAL_DEADLINE to itself. The deadline is
+    enforced by a watchdog that kills the socket at the deadline:
+    per-read socket timeouts alone cannot stop a drip, because
+    each byte that arrives inside the timeout re-arms the wait.
+    When a host resolves to several public IPs, each is tried in
+    turn on connection-level failures. Returns the same dict
+    shape as before."""
+    current = url
+    end = deadline if deadline is not None else \
+        time.monotonic() + _TOTAL_DEADLINE
+    for _hop in range(_MAX_REDIRECTS + 1):
+        err, parts, port = _preflight(current)
+        if err:
+            return {"ok": False, "status": None, "final_url": current,
+                    "headers": {}, "body": "", "error": err}
+        host = parts.hostname
+        try:
+            ips = _public_ips(host)
+        except BlockedTarget as e:
+            return {"ok": False, "status": None, "final_url": current,
+                    "headers": {}, "body": "", "error": str(e)}
+        path = parts.path or "/"
+        if parts.query:
+            path += "?" + parts.query
+        host_hdr = host if port in (80, 443) and \
+            parts.port is None else f"{host}:{port}"
+        last_err = None
+        redirected = False
+        for ip in ips:
+            remaining = end - time.monotonic()
+            if remaining <= 0:
+                return {"ok": False, "status": None,
+                        "final_url": current, "headers": {}, "body": "",
+                        "error": "scan timed out: total deadline "
+                                 f"({_TOTAL_DEADLINE}s) exceeded"}
+            timeout = max(1.0, min(_TIMEOUT, remaining))
+            conn = None
+            watchdog = None
+            try:
+                if parts.scheme == "https":
+                    conn = _PinnedHTTPS(ip, port, host, timeout)
+                else:
+                    conn = http.client.HTTPConnection(ip, port,
+                                                      timeout=timeout)
+                conn.request("GET", path,
+                             headers={"User-Agent": _UA,
+                                      "Host": host_hdr,
+                                      "Accept": "*/*",
+                                      "Connection": "close"})
+                if getattr(conn, "sock", None) is not None:
+                    watchdog = threading.Timer(
+                        max(0.0, end - time.monotonic()),
+                        _kill_conn, args=(conn,))
+                    watchdog.daemon = True
+                    watchdog.start()
+                resp = conn.getresponse()
+                status = resp.status
+                headers = _headers_dict(resp)
+                location = None
+                for k, v in headers.items():
+                    if k.lower() == "location":
+                        location = v
+                if status in (301, 302, 303, 307, 308) and location:
+                    current = urllib.parse.urljoin(current, location)
+                    redirected = True
+                    break
+                raw = _read_capped(resp, end - time.monotonic(),
+                                   sock=getattr(conn, "sock", None))
+                body = raw.decode("utf-8", "replace")
+                return {"ok": status < 400, "status": status,
+                        "final_url": current, "headers": headers,
+                        "body": body,
+                        "error": None if status < 400
+                        else f"HTTP {status}"}
+            except Exception as e:  # DNS, TLS, timeout, refused
+                last_err = e
+            finally:
+                if watchdog is not None:
+                    watchdog.cancel()
+                if conn is not None:
+                    try:
+                        conn.close()
+                    except Exception:
+                        pass
+        if time.monotonic() >= end:
+            return {"ok": False, "status": None,
+                    "final_url": current, "headers": {}, "body": "",
+                    "error": "scan timed out: total deadline "
+                             f"({_TOTAL_DEADLINE}s) exceeded"}
+        if redirected:
+            continue
+        return {"ok": False, "status": None, "final_url": current,
+                "headers": {}, "body": "", "error": str(last_err)}
+    return {"ok": False, "status": None, "final_url": current,
+            "headers": {}, "body": "",
+            "error": f"too many redirects (>{_MAX_REDIRECTS})"}
+
+
+
+def _h(headers, name):
+    for k, v in headers.items():
+        if k.lower() == name.lower():
+            return v
+    return ""
+
+
+def scan(url):
+    if not re.match(r"^https?://", url):
+        url = "https://" + url
+    # One deadline for the WHOLE scan: the homepage fetch and all
+    # four phpinfo probes draw from the same _TOTAL_DEADLINE
+    # budget, so a scan can never run ~5x the deadline.
+    end = time.monotonic() + _TOTAL_DEADLINE
+    home = _fetch(url, deadline=end)
+    result = {"target": url, "reachable": home["ok"],
+              "http_status": home["status"], "final_url": home["final_url"],
+              "error": home.get("error"), "signals": {},
+              "php_version": None, "version_source": None,
+              "cms": [], "phpinfo_exposed": False, "verdict": None}
+    if not home["ok"] and home["status"] is None:
+        result["verdict"] = {"status": "unreachable",
+                             "detail": f"Site did not answer: "
+                                       f"{home.get('error')}"}
+        return result
+
+    headers, body = home["headers"], home["body"]
+    xpb = _h(headers, "X-Powered-By")
+    server = _h(headers, "Server")
+    cookies = _h(headers, "Set-Cookie")
+    gen = _h(headers, "X-Generator")
+    if xpb:
+        result["signals"]["x_powered_by"] = xpb
+    if server:
+        result["signals"]["server"] = server
+    if "PHPSESSID" in cookies:
+        result["signals"]["phpsessid_cookie"] = True
+    if gen:
+        result["signals"]["x_generator"] = gen
+
+    # CMS fingerprints
+    m = re.search(r'<meta[^>]+name=["\']generator["\'][^>]+'
+                  r'content=["\']([^"\']+)', body, re.I)
+    meta_gen = m.group(1) if m else ""
+    low = body.lower()
+    if "wp-content" in low or "wp-includes" in low or \
+            "wordpress" in meta_gen.lower():
+        result["cms"].append("WordPress")
+    if "powered by phpbb" in low or "styles/prosilver" in low:
+        result["cms"].append("phpBB")
+    if "joomla" in meta_gen.lower() or "/media/jui/" in low:
+        result["cms"].append("Joomla")
+    if "drupal" in gen.lower() or "/core/modules/" in low:
+        result["cms"].append("Drupal")
+    if meta_gen:
+        result["signals"]["meta_generator"] = meta_gen
+
+    # Exact version disclosure: headers first
+    raw_version_text = ""
+    for src, text in (("X-Powered-By", xpb), ("Server", server)):
+        v = versioning.parse_version(re.search(r"PHP/(\S+)", text).group(1)) \
+            if re.search(r"PHP/(\S+)", text) else None
+        if v:
+            result["php_version"] = versioning.fmt(v)
+            result["version_source"] = src
+            raw_version_text = re.search(r"PHP/(\S+)", text).group(1)
+            break
+
+    # phpinfo probes — an exposed phpinfo both leaks the exact version
+    # and is itself a finding, so the probes run on every scan (the
+    # footprint is the four well-known paths, nothing more). Probes
+    # are built from the final URL's ORIGIN only: appending a probe
+    # path to a deep final URL (…/en/index.php?x=1) would request a
+    # nonsense URL and miss a real exposed phpinfo at the root.
+    _fp = urllib.parse.urlsplit(home["final_url"])
+    base = f"{_fp.scheme}://{_fp.netloc}"
+    for path in _PHPINFO_PATHS:
+        probe = _fetch(base + path, deadline=end)
+        b = probe["body"]
+        if probe["status"] == 200 and "phpinfo()" in b and \
+                re.search(r"PHP Version\s*&?#?\w*\s*([0-9]+\.[0-9]+\.[0-9]+)", b):
+            vm = re.search(r"PHP Version[^0-9]*([0-9]+\.[0-9]+\.[0-9]+)", b)
+            result["phpinfo_exposed"] = True
+            result["signals"]["phpinfo_path"] = path
+            if vm and result["php_version"] is None:
+                result["php_version"] = vm.group(1)
+                result["version_source"] = f"phpinfo ({path})"
+                raw_version_text = vm.group(0)
+            break
+
+    vtuple = versioning.parse_version(result["php_version"])
+    if vtuple:
+        result["verdict"] = versioning.verdict_for(
+            vtuple,
+            distro=versioning.distro_build(raw_version_text))
+    elif result["signals"] or result["cms"]:
+        result["verdict"] = {
+            "status": "indeterminate",
+            "detail": "PHP is present (fingerprinted) but the version is "
+                      "not disclosed, so the patch status cannot be "
+                      "confirmed from outside. Run the deep check (SSH, "
+                      "read-only) for a definitive verdict."}
+    else:
+        result["verdict"] = {
+            "status": "no_php_detected",
+            "detail": "No PHP signals found. The site may not run PHP, or "
+                      "may hide every fingerprint."}
+    return result
+
+
+def render_text(r):
+    lines = [f"Target:      {r['target']}",
+             f"Reachable:   {r['reachable']} (HTTP {r['http_status']})",
+             f"Final URL:   {r['final_url']}"]
+    if r["cms"]:
+        lines.append(f"CMS:         {', '.join(r['cms'])}")
+    if r["php_version"]:
+        lines.append(f"PHP version: {r['php_version']} "
+                     f"(via {r['version_source']})")
+    if r["phpinfo_exposed"]:
+        lines.append("!! phpinfo page is publicly exposed — remove it.")
+    v = r["verdict"]
+    lines.append(f"VERDICT:     {v['status'].upper()}")
+    lines.append(f"             {v['detail']}")
+    if v["status"] == "indeterminate":
+        lines.append("NEXT:        Most well-run sites hide their PHP "
+                     "version, so an outside scan cannot be certain. "
+                     "For a certain answer, run the read-only deep "
+                     "check on the server (it only reads versions and "
+                     "changes nothing):")
+        lines.append("               phppatch deepcheck --host "
+                     "root@your-server")
+        lines.append("             Site ownership is verified before "
+                     "any deeper check. This scan used passive fingerprinting and limited, read-only path checks only — no exploit probes.")
+    return "\n".join(lines)

phpscan/versioning.py

@@ -0,0 +1,152 @@
+"""Version parsing and vulnerability verdicts.
+
+A PHP build is judged against every advisory in data/cves.json. For each
+advisory, supported branches have a fixed-release floor; anything older
+is vulnerable, and any branch below the advisory's EOL line has no fix at
+all (branch upgrade or offline are the only remedies).
+"""
+
+import json
+import os
+import re
+
+_DATA = os.path.join(os.path.dirname(__file__), "data", "cves.json")
+_VERSION_RE = re.compile(r"(\d+)\.(\d+)(?:\.(\d+))?")
+
+
+def load_advisories():
+    with open(_DATA, encoding="utf-8") as f:
+        return json.load(f)["advisories"]
+
+
+def parse_version(text):
+    """Extract the first x.y[.z] version from arbitrary text -> tuple|None."""
+    if not text:
+        return None
+    m = _VERSION_RE.search(str(text))
+    if not m:
+        return None
+    return (int(m.group(1)), int(m.group(2)), int(m.group(3) or 0))
+
+
+def fmt(version):
+    return ".".join(str(p) for p in version)
+
+
+def branch_of(version):
+    return f"{version[0]}.{version[1]}"
+
+
+_DISTRO_RE = re.compile(r"(ubuntu|~deb\d|\+deb\d|-deb\d|\.deb\d|debian)",
+                        re.I)
+
+
+def distro_build(text):
+    """True when a raw version string looks like a distribution
+    package build (Ubuntu/Debian-style suffix). Distros backport
+    security fixes without moving the upstream version, so a
+    below-floor distro build is a 'check' signal, not proof."""
+    return bool(text and _DISTRO_RE.search(str(text)))
+
+
+def verdict_for(version, distro=False):
+    """Return a verdict dict for one PHP version tuple.
+
+    status: 'patched' | 'vulnerable' | 'possibly_vulnerable' |
+            'eol' | 'not_assessed' | 'unknown'
+      patched    — at or above every advisory floor for its branch
+      vulnerable — a patched release exists for its branch; it is below it
+      possibly_vulnerable — same, but the build looks like a distro
+                   package (backports may already carry the fix)
+      eol        — branch is below an advisory's EOL line: no fix exists
+      not_assessed — branch is newer than the advisory database
+      unknown    — version could not be determined
+    """
+    if version is None:
+        return {"status": "unknown", "version": None, "branch": None,
+                "detail": "PHP version could not be determined."}
+    branch = branch_of(version)
+    problems = []
+    assessed = False
+    for adv in load_advisories():
+        eol_below = parse_version(adv["eol_below"])
+        if (version[0], version[1]) < (eol_below[0], eol_below[1]):
+            detail = (f"Branch {branch} is end-of-life for "
+                      f"{adv['id']}: no patched release exists. "
+                      "The php2shell vector can be only partially "
+                      "mitigated at best by configuration "
+                      "(session.upload_progress.enabled = Off); the "
+                      "only complete remedies are a branch upgrade "
+                      "or taking the site offline.")
+            if distro:
+                detail += (" This build looks like a distribution "
+                           "package: the distro may still backport "
+                           "fixes for this branch, so confirm via "
+                           "the distro security tracker or the "
+                           "on-server deep check.")
+            return {"status": "eol", "version": fmt(version),
+                    "branch": branch, "advisory": adv["id"],
+                    "cves": adv["cves"], "detail": detail,
+                    "remediation": ("Upgrade to a supported PHP branch "
+                                    "(8.2 or later) and apply its patched "
+                                    "release, or take the site offline.")}
+        floor_txt = adv["fixed_releases"].get(branch)
+        if floor_txt is None:
+            continue  # branch newer than the advisory knows
+        assessed = True
+        floor = parse_version(floor_txt)
+        if version < floor:
+            problems.append({"advisory": adv["id"], "cves": adv["cves"],
+                             "cvss_v4": adv.get("cvss_v4"),
+                             "floor": floor_txt})
+    if problems:
+        p = problems[0]
+        detail = (f"PHP {fmt(version)} is below the patched "
+                  f"release {p['floor']} for branch {branch} "
+                  f"({', '.join(p['cves'])}).")
+        if distro:
+            detail += (" This build looks like a distribution "
+                       "package: distros backport security fixes "
+                       "without changing the upstream version, so "
+                       "treat this as a check signal, not proof — "
+                       "confirm via the distro security tracker or "
+                       "the on-server deep check.")
+        remediation = (f"Upgrade PHP {branch} to {p['floor']} or later.")
+        if distro:
+            remediation += (" Confirm via the distro security tracker "
+                            "that a backported fix is installed — a "
+                            "distribution package may already be patched.")
+        return {"status": "possibly_vulnerable" if distro
+                else "vulnerable",
+                "version": fmt(version),
+                "branch": branch, "advisory": p["advisory"],
+                "cves": p["cves"], "cvss_v4": p.get("cvss_v4"),
+                "floor": p["floor"], "detail": detail,
+                "remediation": remediation}
+    if not assessed:
+        return {"status": "not_assessed", "version": fmt(version),
+                "branch": branch,
+                "detail": f"PHP {fmt(version)} is on branch {branch}, "
+                          "which is newer than this scanner's "
+                          "advisory database, so its patch status "
+                          "was not assessed. Update the advisory "
+                          "data and scan again."}
+    return {"status": "patched", "version": fmt(version), "branch": branch,
+            "detail": f"PHP {fmt(version)} is at or above every patched "
+                      "release floor for its branch. 'Patched' covers "
+                      "only the advisories in this database — it is "
+                      "not a general security guarantee."}
+
+
+def fixed_tag_for(version, variant):
+    """Official docker php image tag for the patched release of a branch.
+
+    e.g. version (8,3,35), variant 'apache' -> 'php:8.3.36-apache'
+    Returns None when no advisory floor applies.
+    """
+    v = verdict_for(version)
+    if v["status"] in ("vulnerable", "possibly_vulnerable"):
+        return f"php:{v['floor']}-{variant}"
+    if v["status"] == "patched":
+        return f"php:{fmt(version)}-{variant}"
+    return None

phpscan-1.4.4.dist-info/METADATA

@@ -0,0 +1,294 @@
+Metadata-Version: 2.4
+Name: phpscan
+Version: 1.4.4
+Summary: Free external PHP vulnerability scanner (php2shell / CVE-2026-109618, CVE-2026-109619) — passive fingerprinting plus limited, read-only path checks. No exploit probes.
+Author: Superstar Telecom LLC
+License: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# phpscan — free open-source PHP vulnerability scanner
+
+**Is your PHP version vulnerable to php2shell?** phpscan is a
+free, disclosure-only scanner that answers that question for any
+public website. It checks the PHP version a site discloses against
+the fixed releases for **php2shell — CVE-2026-109618 /
+CVE-2026-109619** (CVSS v4 9.2, unauthenticated remote code
+execution in PHP core) — and, more generally, against the branch
+floors in its advisory database.
+
+It is the open-source scanner behind [phpatch.com](https://phpatch.com).
+
+[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
+[![Dependencies: zero](https://img.shields.io/badge/dependencies-zero-brightgreen.svg)](#what-it-does)
+[![Tests](https://github.com/PHPatch/phpscan/actions/workflows/tests.yml/badge.svg)](https://github.com/PHPatch/phpscan/actions/workflows/tests.yml)
+
+## What it does
+
+- **Disclosure-only.** It reads what a site already discloses
+  publicly — `X-Powered-By` / `Server` headers, `PHPSESSID` cookies,
+  generator tags — plus a limited check for a publicly exposed
+  phpinfo page at a few well-known paths. It never sends an exploit
+  probe, a crafted payload, or anything designed to trigger the bug.
+- **Honest verdicts.** If a site hides its version, the scanner
+  says so (VERSION HIDDEN) instead of guessing. If a build looks
+  like a distribution package, a below-floor version is reported
+  as a check signal (POSSIBLY VULNERABLE), because distros backport
+  fixes without changing the version string.
+- **Public targets only.** The fetcher refuses loopback, private
+  and link-local addresses (including cloud metadata endpoints),
+  non-HTTP(S) schemes and ports other than 80/443, pins the
+  validated IP, and re-validates every redirect — it is designed
+  so it cannot be pointed at internal services. The refusals are
+  exercised by the test suite in `tests/` on every push.
+- **Zero dependencies.** Python 3.11+ standard library only.
+
+## Verdicts
+
+Every scan returns one JSON object per URL. The `verdict.status`
+field uses the vocabulary below (shown here in its display form).
+Actionable verdicts (`vulnerable`, `possibly_vulnerable`, `eol`)
+also carry a `remediation` field naming the upgrade that fixes
+them; patched verdicts carry none.
+
+| Verdict | JSON `status` | Meaning |
+|---|---|---|
+| **VULNERABLE** | `vulnerable` | The disclosed version is below the fixed release for its branch, and a patched release exists. |
+| **POSSIBLY VULNERABLE** | `possibly_vulnerable` | Below the floor, but the build looks like a distribution package — distros backport fixes, so this is a check signal, not proof. |
+| **PATCHED** | `patched` | The disclosed version is at or above every advisory floor for its branch. (Not a general security guarantee — only "not below the fixed releases in the database.") |
+| **END OF LIFE** | `eol` | The branch is below the advisory's EOL line (< 8.2 for php2shell): no patched release exists. The only complete remedies are a branch upgrade or taking the site offline. |
+| **VERSION HIDDEN** | `indeterminate` | PHP is present but the version is not disclosed, so patch status cannot be confirmed from outside. Most well-run sites land here. |
+| **NOT ASSESSED** | `not_assessed` | The branch is newer than the advisory database, so the scanner cannot judge it. |
+
+Two more statuses cover the scan itself: `no_php_detected` (no PHP
+signals found) and `unreachable` (the site did not answer, or the
+target was refused by the safety policy).
+
+## Sample session
+
+Recorded against a local test fixture that discloses
+`X-Powered-By: PHP/8.3.20` — the output format is exactly what the
+tool prints:
+
+```console
+$ python3 -m phpscan http://fixture.example
+{
+ "target": "http://fixture.example",
+ "reachable": true,
+ "http_status": 200,
+ "final_url": "http://fixture.example",
+ "error": null,
+ "signals": {
+  "x_powered_by": "PHP/8.3.20",
+  "server": "Apache/2.4.62"
+ },
+ "php_version": "8.3.20",
+ "version_source": "X-Powered-By",
+ "cms": [],
+ "phpinfo_exposed": false,
+ "verdict": {
+  "status": "vulnerable",
+  "version": "8.3.20",
+  "branch": "8.3",
+  "advisory": "php2shell-2026-10",
+  "cves": [
+   "CVE-2026-109618",
+   "CVE-2026-109619"
+  ],
+  "cvss_v4": 9.2,
+  "floor": "8.3.36",
+  "detail": "PHP 8.3.20 is below the patched release 8.3.36 for branch 8.3 (CVE-2026-109618, CVE-2026-109619)."
+ }
+}
+$ echo $?
+1
+```
+
+Exit code 1 = an actionable finding. A site that runs PHP but
+hides its version returns the VERSION HIDDEN verdict instead
+(verdict block shown; the rest of the object lists the signals it
+did see):
+
+```json
+"verdict": {
+ "status": "indeterminate",
+ "detail": "PHP is present (fingerprinted) but the version is not disclosed, so the patch status cannot be confirmed from outside. Run the deep check (SSH, read-only) for a definitive verdict."
+}
+```
+
+## Branch floors (php2shell)
+
+A branch is PATCHED at or above its fixed release; anything below
+it is VULNERABLE (or POSSIBLY VULNERABLE for distro builds):
+
+| PHP branch | Fixed in |
+|---|---|
+| 8.2 | **8.2.35** |
+| 8.3 | **8.3.36** |
+| 8.4 | **8.4.27** |
+| 8.5 | **8.5.12** |
+| < 8.2 | No fix — **END OF LIFE** (branch upgrade or offline) |
+
+The floors live in `phpscan/data/cves.json`, reviewed against
+the php.net release announcements on every PHP security release
+(see [Advisory data](#advisory-data)).
+
+## Install
+
+```bash
+git clone https://github.com/PHPatch/phpscan.git
+cd phpscan
+# Python 3.11+ standard library only — no pip install, no dependencies.
+```
+
+Or install it directly from GitHub, no clone needed:
+
+```bash
+pip install git+https://github.com/PHPatch/phpscan.git
+python3 -m phpscan https://your-site.com
+```
+
+## Run it
+
+From the clone, run it right there — no install step:
+
+```bash
+python3 -m phpscan https://your-site.com
+```
+
+Prefer a zip? Download `phpscan.zip` from phpatch.com, then
+either install it and run from anywhere:
+
+```bash
+python3 -m pip install phpscan.zip
+python3 -m phpscan https://your-site.com
+```
+
+or unzip and run in place:
+
+```bash
+unzip phpscan.zip
+cd phpscan
+python3 -m phpscan https://your-site.com
+```
+
+Output is one JSON object per URL: the verdict, the disclosed PHP
+version and where it was disclosed, and CMS fingerprints.
+
+Exit codes (for scripts and CI): **0** — scanned, no actionable
+finding; **1** — at least one target is `vulnerable`,
+`possibly_vulnerable`, or on an end-of-life branch; **2** — usage
+error, or a target could not be judged at all: unreachable, or
+`not_assessed` (its PHP branch is newer than the advisory
+database, so the scanner cannot judge it). With several targets,
+the worst code wins.
+
+Prefer a browser? The same scan runs free at
+[phpatch.com](https://phpatch.com) and includes a PDF report.
+
+## How it compares
+
+The php2shell scanners that appeared in October 2026 differ
+mostly in **how they decide you are vulnerable** — and in whether
+they try to trigger the bug to find out:
+
+| Tool | Detection | Sends exploit triggers? | Remediation | License |
+|---|---|---|---|---|
+| **phpscan** (this repo) | Version fingerprint from what the site discloses; says "version hidden" instead of guessing | **No — never** | Via [PHP Patch Assurance](https://phpatch.com): snapshot-first patch, verify, rollback, evidence report | MIT |
+| OpenAI php2shell-checker | Version fingerprint from `X-Powered-By` / `Server` headers only | No | None | Apache-2.0 |
+| Searchlight Cyber php2shell-scanner | Behavioral — crafted multipart probes force PHP out of memory and watch for the crash | **Yes, deliberately** | None | No LICENSE file |
+| SamJUK php2shell-check | Behavioral, local — observes how the installed PHP binary terminates at its memory limit | Only against a throwaway local CLI process | None | MIT |
+| squiblyza php_vuln_scan | Version fingerprint from headers/markup, plus version-disclosure hunting | No | None | MIT |
+| JoasASantos php2shell-scanner | Version fingerprint + subdomain recon + origin scan | Optional opt-in probe (README warns of DoS risk) | None | README states MIT; no LICENSE file |
+
+Full criteria, the fairness notes (behavioral checks catch
+backports; crash signals also misfire on some patched builds),
+SSRF-safety comparison and an FAQ:
+**[PHP vulnerability scanners compared](https://phpatch.com/compare)**.
+
+## What it doesn't do
+
+- **It doesn't patch anything.** The scanner is read-only and
+  external; it cannot change your server.
+- **It can't see a hidden version.** From outside, VERSION HIDDEN
+  is the honest end of the road — a definitive verdict for those
+  sites needs a read-only look on the server itself.
+- **It doesn't monitor or alert.** It's a point-in-time check you
+  run; it won't notice next month's advisory for you.
+- **It isn't a general security audit.** It judges the disclosed
+  PHP version against its advisory database — nothing more.
+
+Patching, on-server verification, rollback, an evidence work
+report, and monitoring are what the hosted service adds:
+**[PHP Patch Assurance — phpatch.com](https://phpatch.com)**.
+
+## Guides and further reading
+
+- **[Self-hoster guides](https://phpatch.com/guides)** — update
+  PHP in Docker and with apt, mod_php vs PHP-FPM, rollback,
+  health checks, version checks, end-of-life upgrades, and
+  patching without downtime, written from the patch flow the
+  service itself uses.
+- **[php2shell fix guide](https://phpatch.com/threats/php2shell)**
+  — what php2shell is, who is affected, how to check and patch,
+  the fixed releases, and the primary sources.
+- **[Case study: mitbbs.ai](https://phpatch.com/case-studies/mitbbs-ai)**
+  — how a bilingual news portal patched php2shell on disclosure
+  night: 8.3.35 to 8.3.36 under mod_php, about 10 seconds of
+  downtime, verified live, no compromise found.
+
+## Authorized use
+
+Only scan sites you own or have permission to scan. The hosted
+scanner at phpatch.com additionally enforces rate limits and an
+opt-out blocklist for site operators (see the Terms, section 8).
+
+## Advisory data
+
+`phpscan/data/cves.json` is the advisory database the scanner
+judges against — branch floors, fixed releases, references and the
+leak/exploitation timeline. Last updated 2026-10-22. Update
+process: floors are reviewed against the php.net release
+announcements on every PHP security release and at least monthly.
+Corrections are welcome as pull requests; every change to this
+file requires maintainer review (see CODEOWNERS), because it
+changes the verdicts the scanner gives.
+
+A verdict of `patched` means only that the disclosed version is
+not below the fixed releases in this database — it is not a
+general security guarantee. A version below a floor on a
+distribution build (Ubuntu/Debian packages) is a "check" signal,
+not proof: distros backport fixes without changing the upstream
+version, and the scanner says so when it detects a distro build.
+
+## Support the project
+
+phpscan is free and MIT-licensed, and the hosted scanner at
+[phpatch.com](https://phpatch.com) is free for every site. If
+the scanner, the threat desk or the daily Mega-Vuln Alert
+reports helped you, you can chip in at
+**[phpatch.com/donate](https://phpatch.com/donate)** — any
+amount from $1, one-time, via Stripe. Donations fund phpscan
+development, the free hosted scans and the public threat
+research. Plainly stated on the page: PHPatch is operated by
+Superstar Telecom LLC, a for-profit company, so donations are
+voluntary support — not tax-deductible, and they buy no
+product, service or entitlement.
+
+## Scanned by phpscan badge
+
+If you scan your site with phpscan, you can show it:
+
+[![Scanned by phpscan](https://img.shields.io/badge/scanned%20by-phpscan-blue.svg)](https://phpatch.com)
+
+```markdown
+[![Scanned by phpscan](https://img.shields.io/badge/scanned%20by-phpscan-blue.svg)](https://phpatch.com)
+```
+
+## License
+
+MIT. Not affiliated with the PHP Group. PHP is a trademark of the
+PHP Group.

phpscan-1.4.4.dist-info/RECORD

@@ -0,0 +1,11 @@
+phpscan/__init__.py,sha256=cSsFxexdWPrCuqxiHn7TJXLOd6_xKnUP7L28Lgv3-Hc,659
+phpscan/__main__.py,sha256=DrADbMIYtAwX2v_7kyKFXBwQq1CsA6E1GBQPHn7v05o,1501
+phpscan/scan.py,sha256=maRaYbhqIkpOffEiZ4UeO3Q3aU-DrMBU2YlN3SOCHVc,19381
+phpscan/versioning.py,sha256=t41-cRBeD6k4hVtrzQSBKtt9HHq5Z3iSuHBmsJ_208k,6705
+phpscan/data/cves.json,sha256=BfQcph-_-qsahk4o7gNhZkh9WSWPkJ2AGZ8qxoNcpXM,2513
+phpscan-1.4.4.dist-info/licenses/LICENSE,sha256=JJcWb6zutNQNCoxUfL1OPnUO8-_HIQWZVwVl2Iz5Pfw,1078
+phpscan-1.4.4.dist-info/METADATA,sha256=jwZSFm_D2XQTqsvRIJ8ZK-IM8g4C6n8iz9OAXbggHxA,12356
+phpscan-1.4.4.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+phpscan-1.4.4.dist-info/entry_points.txt,sha256=NqtI7kPoTLHH0y3LbsvZwXHKjl4ONIzP29V8bSywBHA,49
+phpscan-1.4.4.dist-info/top_level.txt,sha256=VKM8ob5q-eJyegfCvUcuJPUMlu6nrveozgCPGLrhFV0,8
+phpscan-1.4.4.dist-info/RECORD,,

phpscan-1.4.4.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

phpscan-1.4.4.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+phpscan = phpscan.__main__:cli

phpscan-1.4.4.dist-info/licenses/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) 2026 Superstar Telecom LLC
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

phpscan-1.4.4.dist-info/top_level.txt

@@ -0,0 +1 @@
+phpscan