SHELLSCOPE

   ____  _   _ _____ _      _      ____   ____  _____ ______
  / ___|| | | | ____| |    | |    / ___| / ___||  _ \|  ____|
  \___ \| |_| |  _| | |    | |    \___ \| |    | |_) | |__
   ___) |  _  | |___| |___ | |___  ___) | |___ |  _ <|  __|
  |____/|_| |_|_____|_____|_____||____/ \____||_| \_\_____|

2shell exposure auditor — find your own before they find you.

shellscope checks an authorized network for two 2026 CVE clusters:

• Plex2Shell — CVE-2026-96652 / -96654 / -96655 / -96656 (Plex Media Server < 1.43.3.10861)
• php2shell — CVE-2026-109618 / -109619 (PHP session.upload_progress)

It reads version banners and HTTP headers. It does not exploit, authenticate, upload, or trigger the memory bug.

Install

pipx install shellscope
# or
python -m pip install shellscope

From source:

python -m pip install -e ".[dev]"

Use

# prove the install works, no network traffic
shellscope --self-test

# see what would be scanned
shellscope --cidr 192.168.1.0/24 --dry-run

# audit your network
shellscope --cidr 10.0.0.0/24 --authorized

# inventory CSV: host,port,owner,environment
shellscope --inventory-csv assets.csv --authorized --html report.html

# CI gate
shellscope --inventory-csv assets.csv --authorized --fail-on high --quiet

--authorized is required for a real scan. It is your assertion that you own the network or have written permission to test it.

What it checks

CVE set	Probe	Verdict
Plex2Shell	GET /identity → version	< 1.43.3.10861 → CRITICAL
php2shell	GET / → Server, X-Powered-By, PHPSESSID	Apache + PHP below fixed → HIGH
php2shell	same	nginx/LiteSpeed + below fixed → MEDIUM
php2shell	same	Apache + version hidden → MEDIUM (verify)
—	open port, no fingerprint	INFO

PHP fixed versions (leak-based until the official advisory): 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.

The HIGH/MEDIUM split is intentional: the surviving php2shell bug is reported as Apache prefork + mod_php only, not a generic PHP RCE.

Output

• --out audit.csv — one row per finding (default shellscope-results.csv)
• --json audit.json — metadata + findings
• --html audit.html — dark, self-contained report with filter and sort

Demo

$ shellscope --cidr 127.0.0.1/32 --ports 32400,8888 --force-checks --authorized

  [scope] 1 assets / 2 checks
  CRITICAL  127.0.0.1:32400  Plex Media Server 1.43.2.10664  Vulnerable to Plex2Shell
  HIGH      127.0.0.1:8888   PHP 8.2.34                 PHP 8.2.34 < 8.2.35 on Apache

  SUMMARY
  CRITICAL    1  #
  HIGH        1  #
  TOTAL       2

Safety

• --authorized is mandatory for a real scan.
• Private/loopback ranges by default; public ranges require --allow-public.
• --max-hosts, --workers, and --delay bound the scan.
• One read-only request per open port. No payloads, no auth bypass, no DoS.

Use it only on networks you own or have written permission to test. A bug bounty scope is not a license to scan the internet; it authorizes listed assets under that program's rules.

Notes

• CDNs hide the origin. A Server header can describe Cloudflare, not the PHP build.
• X-Powered-By is often disabled. A missing header is not proof of a patch.
• Version ≠ exploitation. The tool tells you where to look, not that a host is compromised.
• PHP fixed versions are leak-based. Confirm them against the official advisory.

Exit codes

Code	Meaning
0	Scan completed, no findings at/above --fail-on
1	Findings at/above --fail-on
2	Usage or authorization guard

Development

python -m pip install -e ".[dev]"
python -m pytest
python -m ruff check src tests
python -m shellscope --self-test

License

MIT. Authorized use only.