EXP IP Scanner 1.4.0

Find PHP2Shell exposure without turning the scanner into an exploit tool.

Version 1.4.0 adds a focused passive security layer for PHP2Shell. Check every web-enabled device found on a network, or paste a website URL and check it directly.

Check the whole network after discovery

After a normal network scan, press Security to check discovered HTTP and HTTPS services. EXP IP Scanner runs a bounded passive assessment, shows progress, and marks Critical or Needs Review devices with subtle shield indicators. Use the Issues filter to isolate them immediately.

Know when an exposed PHP version is below the fix

The scanner looks for PHP runtime indicators and disclosed versions, then compares supported PHP 8.2 through 8.5 branches with the upstream fixed releases for CVE-2026-109618 and CVE-2026-109619. A positively affected disclosed version is Critical. A hidden version is Needs Review rather than a guess.

Check a public website by hostname

The new Website check accepts a bare hostname or a full HTTP/HTTPS URL. It keeps the original hostname through HTTPS so SNI, reverse proxies, Cloudflare, and virtual-hosted sites are checked the way a browser reaches them.

Passive by design

The security pass uses ordinary HTTP and HTTPS requests only. It does not send exploit payloads, execute code, or automatically perform destructive validation. A Clear result means no affected upstream PHP version was exposed by the checked response, not that hidden backend software is guaranteed patched.

Better field behavior

Web fingerprinting now runs without flashing Command Prompt windows. Network-wide checks are limited to four devices at a time, and Synology DSM ports 5000 and 5001 are included in the default scan so common NAS management surfaces are easier to identify.

Security maintenance under the hood

The Rust dependency set was refreshed for current TLS and certificate-validation fixes. The desktop updater is pinned to an exact official Tauri source revision that uses the patched ZIP 9 dependency line.