v0.1.1: php2shell (CVE-2026-109618, CVE-2026-109619) fix table from php.net

php2shell-repo-audit 0.1.1 lists the PHP versions your repos declare and sorts them by what needs the php2shell fix for CVE-2026-109618 and CVE-2026-109619, using the fixed versions from php.net's advisory.

What's new

• --check-upstream: for floating official php tags such as php:8.3-fpm, asks Docker Hub which PHP the tag's current image sets and says "upstream rebuilt with 8.3.x, rebuild and redeploy now" or "not rebuilt yet, check again later". Findings stay in CHECK MANUALLY, because your own image is old until you rebuild it. Anonymous and rate limited, so lookups are cached per run and a failure falls back to the normal message.
• --repo owner/name: scans one GitHub repo through the API without cloning. A token is optional for public repos.
• CI and dev findings now say they are lower exposure than a web-serving runtime, following php.net's advisory. Buckets don't change.
• JSON: repo (with --repo) and findings[].upstream (with --check-upstream) are new fields; schemaVersion stays 1.

Fix table in this release (rev 2, 2026-10-21)

Branch	Fixed in
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35

5.x, 7.x, 8.0 and 8.1 get no official php.net release and are ACTION REQUIRED; php.net published source backport branches for 7.4, 8.0 and 8.1, and some vendors backport. If you can't update right now, the advisory lists mitigations that reduce exposure but don't fix it. The table is filled by hand from the advisory and checked against php.net's per-branch release data (scripts/check-fixes.mjs).

Run it

npx php2shell-repo-audit@0.1.1 path/to/repo
npx php2shell-repo-audit@0.1.1 --org your-org --markdown > php2shell.md

- uses: actions/checkout@v4
- uses: Amsozzer1/php2shell-repo-audit@d767e2cc5d456c3b9b55ef225b6e313da268e79e # v0.1.1

It reads files in git, and with --org the GitHub REST API (read-only). It does not check running servers and does not test for the bug. It never says a repo is fine: DECLARED ≥ FIXED always means "runtime not verified".

Measured

On 4 held-out public repos with 42 labeled declarations, the tool found 36 and grep -rnE "FROM +php:" found 16. That is a small set from one labeling pass, made with an AI coding assistant before the tool was run, and recall only covers the file types the labels covered. Method: results/numbers.md.

npm: php2shell-repo-audit@0.1.1, published from the release workflow with provenance.

v0.1.0: php2shell (CVE-2026-109618, CVE-2026-109619) fix table from php.net

php2shell-repo-audit 0.1.0 lists the PHP versions your repos declare and sorts them by what needs the php2shell fix for CVE-2026-109618 and CVE-2026-109619, using the fixed versions from php.net's advisory.

Fix table in this release (rev 2, 2026-10-21)

Branch	Fixed in
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35

5.x, 7.x, 8.0 and 8.1 get no official php.net release and are ACTION REQUIRED; php.net published source backport branches for 7.4, 8.0 and 8.1, and some vendors backport. If you can't update right now, the advisory lists mitigations that reduce exposure but don't fix it. The table is filled by hand from the advisory and checked against php.net's per-branch release data (scripts/check-fixes.mjs).

Run it

npx php2shell-repo-audit@0.1.0 path/to/repo
npx php2shell-repo-audit@0.1.0 --org your-org --markdown > php2shell.md

- uses: actions/checkout@v4
- uses: Amsozzer1/php2shell-repo-audit@b2483e019dfb93a771678fa0dcdb460669542bdd # v0.1.0

It reads files in git, and with --org the GitHub REST API (read-only). It does not check running servers and does not test for the bug. It never says a repo is fine: DECLARED ≥ FIXED always means "runtime not verified".

Measured

On 4 held-out public repos with 42 declarations labeled by hand, the tool found 36 and grep -rnE "FROM +php:" found 16. That is a small set, labeled by one person, and recall only covers the file types the labels covered. Method: results/numbers.md.

npm: php2shell-repo-audit@0.1.0, published from the release workflow with provenance.