Summary
A Concise Overview of the scan result of url https://calif.io/php2shell/
- Document
- HTML
- 1
- StyleSheets
- 1
- Scripts
- 1
- Font
- 0
- Images
- 12
- Links
- 17
- JavaScript Variables
- 13
- Console log messages
- 0
- Network
- Requests
- 15
- Bytes Transferred
- 8MB
- Bytes Total
- 8.07MB
- DNS Record
- A Record
- 1
- Technology
- Webmail
- 1
- Databases
- 1
- Development
- 1
- Video players
- 1
- Security
- 1
- Miscellaneous
- 1
Document
Links
The outgoing links identified from the page.
| Link | Text |
|---|---|
| https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?st=fWYdje&reflink=desktopwebshare_permalink | The Wall Street Journal |
| https://www.nytimes.com/2026/10/21/us/politics/php-vulnerability-ai-openai-cybersecurity.html?unlocked_article_code=1.KVE.ompY.9fTYV5OfCIS5&smid=url-share | The New York Times |
| https://www.cve.org/CVERecord?id=CVE-2026-109618 | CVE-2026-109618 |
| https://www.cve.org/CVERecord?id=CVE-2026-109619 | CVE-2026-109619 |
| https://www.php.net/archive/2026.php#2026-10-21-5 | PHP October 2026 Security Release |
| https://x.com/i0n1c | Stefan Esser |
| https://marc.info/?l=bugtraq&m=108981780109154&w=2 | the first PHP memory limit remote vulnerability |
| https://web.archive.org/web/20051231011715/http://immunitysec.com/downloads/nolimits.pdf | Immunity Inc |
| https://bugs.php.net/bug.php?id=78876 | bug #78876 |
| https://ostif.org/php-audit-complete/ | audit of PHP |
| https://openai.com/index/patch-the-planet/ | Patch the Planet |
| https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/ | Volker Dusch |
| https://github.com/php/php-src/commit/3c8582ca4b8e84e5647220b647914876d2c3b124 | patch |
| https://x.com/lcfr_hax | @lcfr_hax |
| https://x.com/lcfr_hax/status/2085031675382071483 | hash |
| https://www.ibiscraft.art | Ibis Craft |
| https://x.com/lcamtuf | @lcamtuf |
JavaScript Variables
Global JavaScript variables are variables that are defined outside of any function or block scope in JavaScript.
Technology
The technologies identified are present on the scanned URL.
| Name | Description | Detected patterns |
|---|---|---|
| Video players | ||
YouTube | YouTube is a video sharing service where users can create their own profile, upload videos, watch, like and comment on other videos. | Type: html Regex: <(?:param|embed|iframe)[^>]{1,250}youtube(?:-nocookie)?\.com\/(?:v|embed) |
| Security | ||
| HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. | Type: headers Name: strict-transport-security Regex: (?:) | |
| Miscellaneous | ||
HTTP/3 | HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web. | Type: headers Name: alt-svc Regex: h3 |
| Webmail | ||
Apple iCloud Mail | Apple iCloud Mail is a webmail service provided by Apple, Inc. | Type: dns Regex: apple-domain |
| Databases | ||
Firebase | Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps. | Type: headers Name: vary Regex: x-fh-requested-host |
| Development | ||
Firebase | Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps. | Type: headers Name: vary Regex: x-fh-requested-host |
Performance
The speed and efficiency of the scanned URL loads and displays its content.
- dns
- 1 msGood
- tcp
- 1 msGood
- requestTime
- 2 msGood
- dom
- 135 msGood
DNS Record
A DNS record maps a domain name to an IP address or other resource information.
| Type | Name | Content | DNSSEC |
|---|---|---|---|
| A | calif.io | 199.36.158.100 | no |
SSL Certificate
An SSL certificate is a digital certificate that verifies the authenticity and encrypts the communication between a website and its visitors.
| Subject | Issue date | Expiry date | Valid |
|---|---|---|---|
calif.io | 10/21/2026 | 10/22/2027 | 1 year 1 day |
HTTP Headers
HTTP Header
An HTTP header is a component of an HTTP request or response that contains additional information about the message being sent or received.
| Name | Value |
|---|---|
| Accept-Ranges | bytes |
| Cache-Control | max-age=3600 |
| Connection | keep-alive |
| Content-Encoding | br |
| Content-Length | 12276 |
| Content-Type | text/html; charset=utf-8 |
| Date | Thu, 22 Oct 2026 07:32:24 GMT |
| Etag | "c8c30233b20ca37913be773976acac4d068d7a90a1aef3dd207e764bc821df28-br" |
| Last-Modified | Thu, 22 Oct 2026 00:56:01 GMT |
| Strict-Transport-Security | max-age=31556926 |
| Vary | x-fh-requested-host, accept-encoding |
| X-Cache | HIT |
| X-Cache-Hits | 201 |
| X-Robots-Tag | noindex, nofollow, noarchive, nosnippet |
| X-Served-By | cache-sjc1000142-SJC |
| X-Timer | S1792654344.027930,VS0,VE0 |
| alt-svc | h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 |
Content Security Policy
Content Security Policy (CSP) is a security mechanism that helps prevent cross-site scripting (XSS) and other code injection attacks by specifying which content sources are allowed to be loaded on a web page.
| Name | Value |
|---|
Cookies
Cookies are small pieces of data stored on a user's web browser to track and remember information about their browsing activity on a website.
| Name | Value | Domain/Path | Expires | Secure | HTTP Only |
|---|