Free Tool

Website Vulnerability Scanner (incl. php2shell)

Enter your domain and we scan www, http/https and your subdomains for thousands of known vulnerabilities, including php2shell (CVE-2026-109618 / 109619).

To prove ownership, the address must be on the domain you scan (e.g. name@example.com for example.com). Gmail, Outlook and similar addresses are not accepted.

Non-intrusive scan: no brute force, fuzzing, default-password attempts or tests that could disrupt your service.

What this tool does

  • Scans the www and non-www, http and https versions of your domain and the subdomains found in certificate logs.
  • Checks php2shell (CVE-2026-109618 / CVE-2026-109619) first.
  • Runs thousands of daily-updated nuclei templates for known CVEs, exposed .env / .git files, admin panels, SSL and configuration issues.
  • Shows findings with severity and CVE IDs, and emails a detailed report with fixes.

What it doesn’t do

  • It doesn’t attack your site: brute force, fuzzing, default-password attempts and anything that could cause downtime are off.
  • It can’t see your application code or server-side configuration; it only uses what is visible from outside.
  • It won’t scan a domain whose ownership hasn’t been verified.

About version-based findings

Some findings rely on the software version your server reports. Distributions like Ubuntu, Debian or RHEL may ship security fixes under the old version number. If you see such a finding, compare the package version on your server with your distribution’s security advisory.

Website security scan: FAQ

php2shell is the name for two critical PHP flaws patched on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They let an attacker run code on a server running PHP, and exploitation attempts are being reported. Every version since PHP 5.4 is affected; fixes are in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with no official fix for 8.1 and older. The scanner checks the PHP version your server reports, and tells you plainly when the version is hidden.
No. Only non-intrusive tests run: brute force, fuzzing, default-password attempts and anything that could cause downtime are switched off, and the request rate is limited. The traffic appears in your logs as ZeisoftSecurityScanner.
A scan takes a few minutes depending on the size of the site. You don't have to wait: after you click the verification link you can close the page, and the report arrives by email when the scan finishes.
Scan results show a site's weaknesses, so only its owner should see them. The scan only starts after you confirm a link we send to an address on the scanned domain (e.g. name@example.com for example.com). Shared providers like Gmail or Outlook prove nothing about ownership and are not accepted.
We use the open-source ProjectDiscovery tools: subfinder finds your subdomains, httpx checks www / non-www and http / https and detects your tech stack, and nuclei runs thousands of community templates, updated daily, for known CVEs, exposed files (.env, .git and more), admin panels, SSL and configuration issues.
Each finding in the report comes with its severity, CVE ID and a fix. Start with critical and high findings. If you'd like us to fix them, just reply to the report email.

Let's close these gaps together

Talk to our team about PHP and server upgrades, security hardening and regular scans.

Email

hello@zeisoft.com

Phone

+90 530 938 69 63

WhatsApp

+90 530 938 69 63

Address

Atatürk Mh. 2190. Sk. No:2A, 35430 Urla/İzmir

Fill the Form

Average response time: 4 hours