Free self-check tools for the October 2026 cyber crisis
Three critical incidents in one week: PHP2Shell, the poisoned LiteLLM 1.107.0 and eight weak eMudhra CA keys. These scripts tell you in minutes whether a host is exposed. They run on your machine, read only, and send nothing to anyone, including us. That is how security testing should work.
Runs on your machine
No upload, no account, no online scanner. Nothing about your systems leaves your network.
Read-only
The scripts read files and versions. They never change a configuration, delete a file or exploit anything.
Open source, MIT
Plain shell and Python you can read in five minutes. Check the SHA-256 before you run it.
Built on verified facts
Every check comes from our remediation guides, which cite the vendor advisories.
The three checks
PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Finds every PHP build on the host (system, PHP-FPM, cPanel, Plesk, LiteSpeed, Remi, containers with --docker) and compares it with the fixed releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Shows whether mod_php is loaded, which stopgap settings your FPM pools set, and PHP processes that have spawned a shell or a download tool.
Distribution packages often backport the fix without changing the version: those are marked CHECK, so confirm them against your vendor’s notice.
Download, verify, read, run
curl -fsSLO https://zerohunt.ai/self-check/php2shell-check.sh
sha256sum php2shell-check.sh # must print f56a3878ff9c3b62…
less php2shell-check.sh # read it first
sudo sh php2shell-check.sh
Looks for the payload files (cook.pth, cook.py, the malicious sitecustomize.py), the 1.107.0 metadata, the stealer and loader markers, cached wheels, the compromised Docker image digest, Kubernetes pods running it and, given a folder, pinned versions in requirements and lock files. It never starts Python, because on an infected host every Python start runs the stealer again.
Finding nothing does not prove you were safe: containers and /tmp clean-up erase the markers. Check CI logs and egress too.
Download, verify, read, run
curl -fsSLO https://zerohunt.ai/self-check/litellm-check.sh
sha256sum litellm-check.sh # must print e06a1e019bcfc8f3…
less litellm-check.sh # read it first
sudo sh litellm-check.sh ~/src
eMudhra CA keys: Python, pip, uv and OS trust stores
Finds every CA bundle (certifi, the copy inside pip, OS stores, files named by SSL_CERT_FILE and similar) and flags the ones that still trust emSign ECC Root CA - G3 or the Sectigo cross-sign path, plus certifi, pip and uv older than the fixed releases. Use --scan on an exported container filesystem.
Does not read Java keystores, the Windows store or the macOS Keychain. Run it with -S so Python skips .pth files.
Download, verify, read, run
curl -fsSLO https://zerohunt.ai/self-check/trust_store_audit.py
sha256sum trust_store_audit.py # must print ff9aff85f05de454…
less trust_store_audit.py # read it first
python3 -S trust_store_audit.py
A script checks one host. Attackers check your whole network.
Knowing that one server runs an old PHP is the start. The real questions are which of your systems an attacker can reach, what a stolen LiteLLM key opens, and whether a fix actually closed the path. Zero Hunt answers them with an autonomous AI red team on an appliance inside your network, on its own models, with nothing leaving your perimeter.
Yes. They are MIT-licensed scripts with no account, no registration and no usage limit. Use them, share them, adapt them.
Do the scripts send any data to Zero Hunt?
No. They make no network connection at all. They only read files and versions on the machine you run them on and print the result.
Is it safe to run them on production servers?
They are read-only and do not exploit anything. As with any script, read it before you run it and compare the SHA-256 shown on this page.
Why not an online scanner?
An online scanner sees only what is exposed to the internet and needs you to hand a third party a map of your systems. A local check sees the build you actually run, including internal hosts and containers, and keeps that map inside your network.