PHP2Shell v2.8.2

PHP2Shell v2.8.2

Published: 27 October 2026
Tag: v2.8.2

Focused discovery correctness maintenance for confirmed WampServer inventory gaps reported against v2.8.1. Preserves CVE vulnerability thresholds, investigation/telemetry behaviour, active-runtime attestation limits, exit codes, HTML/CSV/status JSON, fleet CSV v3, and report schemas. Does not overwrite v2.8.1 (or earlier) release assets. Offline and read-only by default. No active exploitation, network probing, broad filesystem scanning, PHP binary execution, or unrelated discovery expansion.

Field validation: Automated unit/regression and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green on the discovery merge (PR #47 tip 75b077b / merge bf70ade) and this finalize tip. Synthetic ASERVER2-style WampServer fixture regressions PASS. Real-world ASERVER2 host re-scan remains NOT YET FIELD-VALIDATED for this release — do not treat the synthetic fixture as a substitute. Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix remains NOT TESTED (outstanding from earlier releases). Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.8.2 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0. See README / consultant install guide for unsigned-binary and endpoint-protection guidance (investigate detections first; no broad AV exclusions by default).

What is new

WampServer-style PHP version path inference

• Directory segments formatted as phpX.Y.Z (e.g. C:\wamp64\bin\php\php7.4.33\php.exe) are recognized in addition to bare X.Y.Z
• Inferred versions remain binary_path_inferred_version with provenance path_inferred and confidence MEDIUM
• Path-inferred versions are not verified binary metadata and are not proof of the active HTTP-serving runtime
• Marker-free binaries under these layouts can receive legacy/EOL patch review messaging when a comparable version is inferred — still requiring manual verification

Bounded WampServer configuration discovery

• Apache config roots expanded with bounded globs: C:\wamp64\bin\apache\*\conf, C:\wamp\bin\apache\*\conf (filepath.Glob only; not recursive host-wide scanning)
• Well-known php.ini patterns include C:\wamp64\bin\php\*\php.ini (alongside existing C:\wamp\...)
• Reuses existing Apache / php.ini parsers and coverage semantics
• Static configuration alone still does not verify an active web-serving PHP runtime

Clearer verified / inferred / unknown reporting

• Executive HTML, CLI summary, and binary_paths coverage distinguish:
  • verified binary metadata versions
  • path-inferred versions (MEDIUM; manual verification required)
  • candidates without comparable versions
• Path-inferred findings are not presented as confirmed installations or proven vulnerability exposure

Deduplication across discovery sources

• Apache handler binary follow-up skips re-inventory when the same PHP binary path is already recorded (e.g. well-known / PATH discovery)
• Handler/module configuration evidence is still recorded
• Install grouping and patch assessment stay one logical install tree / one row per distinct binary path

Honesty (required reading)

Observation	Means
Verified binary metadata	Text extracted from embedded/PE markers — still not proof the binary serves HTTP
Path-inferred (phpX.Y.Z / bare X.Y.Z)	Directory-derived inventory lead — MEDIUM confidence; requires manual verification
Apache / php.ini candidates	Configured paths only — not active runtime or effective settings attestation
Active web runtime	Remains unverified unless separately established; inventory never upgrades to “Verified” from path/config alone

Explicitly out of scope for v2.8.2

• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• New telemetry sources, investigation axes, CTI/IOC packs, or CISA KEV / Sigma-rule detection imports
• Active HTTP SAPI attestation (NOT_IMPLEMENTED unchanged)
• Report schema / exit-code / fleet CSV contract changes
• Broad recursive filesystem scanning or executing PHP binaries
• Unrelated well-known path expansion beyond the bounded WampServer roots above
• Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.8.1

• ReliaQuest / Unit 42–aligned investigation assists and confidence ladder
• Bounded nginx / PHP-FPM configuration discovery; Unix PHP symlink discovery; console UX; enterprise quiet/status JSON; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Path-inferred versions are inventory leads, not confirmed installs or proven exposure
• Missing evidence is not a negative finding; absence of PHP findings is not proof a host is PHP-free
• Active HTTP-serving SAPI is still not attested from path inference or Apache/php.ini inventory
• Custom drive letters / nonstandard Wamp layouts still need --config-root / --deep-root / --php-ini
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS (integrity vs published manifest, not independent publisher authentication)
• Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED
• Real ASERVER2 host validation after this publish remains an operator follow-up

See also

• Prior: v2.8.1 · v2.8.0
• Understanding reports: UNDERSTANDING-REPORTS.md

PHP2Shell v2.8.1

PHP2Shell v2.8.1

Published: 25 October 2026
Tag: v2.8.1

Focused security-detection maintenance update informed by public PHP2Shell exploitation research from ReliaQuest and Palo Alto Networks Unit 42. Research was published / widely covered 22–25 October 2026; that research timeline is independent of this product release date (25 October 2026).

Preserves the v2.8.0 discovery surface, exit codes, HTML/CSV/status JSON, fleet CSV v3, and CVE vulnerability thresholds. Does not overwrite v2.8.0 (or earlier) release assets. Offline and read-only by default. No active exploitation, network probing, new telemetry sources, new PHP discovery, DFIR platform expansion, or CVE threshold changes.

Field validation: Automated unit/regression and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green on the detection merge (PR #44 tip / merge 7205591) and this finalize tip. Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix remains NOT TESTED (outstanding from earlier releases) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.8.1 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

PHP memory-corruption and Apache worker-abort indicators

• Detect PHP zend_mm_heap corrupted (php_zend_mm_heap_corrupted)
• Detect Apache AH00052 Abort / SIGABRT (apache_child_abort) in addition to existing Segmentation fault
• Existing Datadog-backed patterns retained: OOM Unknown on line 0, AH00052 Segmentation fault
• Individual heap / OOM / Abort matches are suspected research patterns only — not proof of exploitation or host compromise; they never set CONFIRMED_COMPROMISE

Improved multi-signal error correlation

• correlated_error_sequence when OOM Unknown on line 0 appears with heap corruption and/or worker crash/abort within ≤2 minutes on the same error-log file
• Cross-file / cross-host error joins are refused
• Duplicate identical kind sets emit once (repeated log lines do not multiply sequence findings)
• Apache child pid is extracted when present and disclosed

Conservative handling of time-only evidence

Evidence	Confidence
≥3 distinct research kinds (same file, ≤2m)	suspected
Same Apache WorkerPID on ≥2 distinct crash/abort pattern kinds	suspected (still not same-request proof; duplicate same-kind lines do not count)
Two-kind time-only sequence	unconfirmed
POST 5xx ↔ research error (±15m)	unconfirmed (correlation-only; ordinary apps also return 5xx)
Long POST request-target ↔ error	unconfirmed (unchanged)

POST 5xx events are never standalone attempt leads. Missing or unreliable timestamps cannot create correlations. Missing PID is disclosed and keeps weaker pairings at unconfirmed. Temporal proximity is never presented as proof of one shared HTTP request or process.

Unit 42-related process telemetry markers

• Exact published delimiters ==SHELLUSER== / ==PASSWD== → agentic_section_delimiter only when a web/PHP parent is present
• Raw command lines, credentials, and tokens are never retained
• Lowercase / partial / bare passwd strings and non-web parents do not match

Honesty ladder (unchanged contracts)

• Per-finding confidence (suspected / unconfirmed) is shown separately from host statuses
• Independent statuses: ExploitationAttemptStatus, PossibleCompromiseStatus, InvestigationCoverage, legacy signed-IOC CompromiseStatus
• Missing investigation inputs stay NOT_ASSESSED (not a negative clearance)
• The tool never emits CONFIRMED_COMPROMISE or CLEAN

Explicitly out of scope for v2.8.1

• Detection of every technique described in October 2026 research articles (LDAP/AD tooling inventories, request-body p2s-rider markers, multipart upload-progress values, or access↔error same-request identity when PID is absent)
• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• New PHP discovery, nginx/FPM expansion, RPM/Homebrew/Docker inventory, live EDR/WAF APIs, or new telemetry formats
• Exit-code / status-JSON / fleet CSV schema changes
• Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.8.0

• Bounded nginx / PHP-FPM configuration discovery; Unix PHP symlink discovery; console UX; enterprise quiet/status JSON; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Suspected activity ≠ confirmed compromise; unconfirmed correlations ≠ clearance
• PID on Apache crash/abort lines is not proof that OOM/heap lines or access-log POSTs shared that worker or one HTTP request
• Ordinary access logs typically lack worker PID and never expose request bodies
• WAF query-string presence of PHP_SESSION_UPLOAD_PROGRESS remains presence-only; body/multipart values are unavailable in supported schemas
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS
• Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED

Research sources (publication dates ≠ this release date)

Research	Published / covered	Role in v2.8.1
ReliaQuest Threat Spotlight — PHP2Shell	2026-10-22 (widely covered through 2026-10-25)	Heap corruption, Abort, multi-signal sequence, POST 5xx correlation-only assist
Palo Alto Networks Unit 42 — CVE-2026-109618 / CVE-2026-109619	October 2026 (Oct 25 industry coverage)	Agentic section delimiters in process cmdline classification
The Hacker News roundup	2026-10-25	Industry context only (not a primary pattern source)
Datadog / AWS MadPot patterns	2026-10-21	Prior OOM Unknown line 0 / segfault / investigation floor (retained)

See also

• COMPROMISE-INVESTIGATION.md · Prior: v2.8.0

PHP2Shell v2.8.0

PHP2Shell v2.8.0

Published: 25 October 2026
Tag: v2.8.0

Minor release: bounded nginx / PHP-FPM configuration discovery on Unix well-known paths, with LIVE_DOCKER lab validation (8/8). Preserves v2.7.5 detection classifications for CVE thresholds, exit codes, status JSON, CSV, and fleet consolidation. Does not overwrite v2.7.5 (or earlier) release assets. No Homebrew path expansion, RPM/dnf package-DB inventory, Docker/container runtime product discovery, or CTI/IOC packs in this release.

Field validation: Automated unit/layout/offline contracts and LIVE_DOCKER eight-scenario labs are green (validation merge PR #35; evidence tip 8746899 / Actions run 40211792925; preserved under docs/pr-assets/v2.8.0-nginx-fpm-live/). Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix remains NOT TESTED (outstanding from earlier releases) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.8.0 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

Bounded nginx / PHP-FPM configuration discovery

• Read-only inventory of well-known nginx roots (/etc/nginx, /usr/local/etc/nginx, /usr/local/nginx/conf) and PHP-FPM pool roots (/etc/php/*/fpm/pool.d, /etc/php-fpm.d, /usr/local/etc/php-fpm.d, related seed php-fpm.conf paths)
• Classify fastcgi_pass / upstream backends as local (Unix socket / loopback TCP), remote, ambiguous, or variable-unresolved — with skip/incomplete honesty when configs are unreadable or includes are blocked
• Correlate identical local listen targets between nginx handlers and FPM pools when both are inspectable
• Caps on file count, size, include depth, and symlink hops; no network connect, no DNS, no execution of PHP or package managers

Honesty (required reading)

• nginx/FPM configuration correlation is never proof of the active HTTP-serving PHP runtime or its patch state
• EffectiveWebRuntime remains NOT_VERIFIED when evidence comes from configuration alone
• Remote FastCGI backends are reported as configuration candidates with incomplete coverage — they are not assessed as patched from a local binary
• Missing or skipped configs are not a negative finding that the host is PHP-free

Explicitly out of scope for v2.8.0

• Homebrew / non-well-known prefix expansion for nginx or FPM
• RPM/yum/dnf (or other non-dpkg/apk) package inventory
• Docker / container image or runtime inventory as a product feature
• LiteSpeed / OpenResty-only stacks; Windows nginx
• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• Exit-code / status-JSON / fleet CSV schema changes
• Authenticode signing (still unsigned + SHA256SUMS)
• CTI / IOC packs

Preserved from v2.7.5

• Unix PHP executable symlink discovery; console UX; OS-aware no-PHP reporting; enterprise quiet/status JSON / PSADT–Intune–GPO contracts; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Missing evidence is not a negative finding; absence of PHP findings is not proof a host is PHP-free
• Active HTTP-serving SAPI is still not attested from nginx/FPM config
• Installations and configs outside PATH, existing well-known globs, and operator --config-root / --deep-root remain undiscovered (bounded coverage)
• Variable-only fastcgi_pass and custom prefixes remain incomplete / unsupported
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS
• Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED

See also

• v2.8.0 readiness · nginx/FPM design · LIVE_DOCKER validation design
• Prior: v2.7.5

PHP2Shell v2.7.5

PHP2Shell v2.7.5

Published: 25 October 2026
Tag: v2.7.5

Patch release: Unix PHP executable symlink discovery (bounded resolve, relevant unresolved-candidate reporting, alias path retention without duplicate installs). Preserves v2.7.4 detection classifications, exit codes, status JSON, CSV, and fleet consolidation. Does not overwrite v2.7.4 (or earlier) release assets. No nginx, PHP-FPM pool config, RPM/dnf package-DB, Docker, or broader Phase A/B/C discovery expansion in this release.

Field validation: Automated regression tests and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green on the merged symlink-discovery work (PR #32) and this finalize tip. Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix remains NOT TESTED (outstanding from v2.7.4) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.5 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

Unix PHP executable symlink discovery

• Resolve phpBin-named file symlink chains within an explicit hop budget (Homebrew Cellar aliases, /etc/alternatives chains, versioned php8.x / php-cgi / php-fpm PATH names)
• Inspect the resolved regular file only — never execute PHP or package managers
• Deduplicate installs by resolved path while retaining operator-facing aliases (via symlink / also_via_symlink)
• Windows file-symlink rejection (isSafeRegularFile) and directory reparse behaviour unchanged

Relevant unresolved candidates

• Permission-denied and over-budget symlink chains leave PHP_EXECUTABLE_CANDIDATE_UNRESOLVED_NOT_INSPECTED evidence
• Prevents a soft NO_PHP_DETECTED_WITHIN_SCAN_COVERAGE conclusion when a relevant PHP executable candidate could not be inspected
• Broken, circular, and non-regular targets stay silent (no incomplete-scan noise)

Explicitly out of scope for v2.7.5

• nginx / PHP-FPM pool configuration discovery
• RPM/yum/dnf (or other non-dpkg/apk) package inventory
• Docker / container image inventory
• Homebrew well-known path expansion beyond PATH + existing Linux globs
• Phase A no-PHP messaging redesign beyond the unresolved-candidate honesty fix above
• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• Exit-code / status-JSON / fleet CSV schema changes
• Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.7.4

• Console UX / reliability polish; OS-aware no-PHP reporting; enterprise quiet/status JSON / PSADT–Intune–GPO contracts; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Missing evidence is not a negative finding; absence of PHP findings is not proof a host is PHP-free
• Active HTTP-serving SAPI is still not attested
• PHP installations outside PATH, existing well-known globs, and operator --config-root / --deep-root remain undiscovered (bounded coverage — not complete host inventory)
• Deep Discovery still does not follow file symlinks as tree edges
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS
• Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED

See also

• Merged discovery work: PR #32 (fix/unix-php-symlink-discovery)
• UNDERSTANDING-REPORTS.md
• EXIT-CODES-AND-DEPLOYMENT.md
• Index: RELEASE-NOTES.md

PHP2Shell v2.7.4

PHP2Shell v2.7.4

Published: 25 October 2026
Tag: v2.7.4

Patch release: console UX and operational reliability for ordinary IT administrators and enterprise deployments. Preserves v2.7.3 detection classifications, exit codes, status JSON, CSV, and fleet consolidation. Does not overwrite v2.7.3 (or earlier) release assets. No new scanning features, CVEs, WAF/DFIR integrations, or threshold changes.

Field validation: Automated regression tests and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green. Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix is NOT TESTED (outstanding) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.4 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

Windows console compatibility

• Explicit --no-color (also respects NO_COLOR); does not change the --quiet automation contract
• Best-effort Windows Virtual Terminal enablement with safe plain-text fallback (Server 2012 R2 / legacy conhost) — VT failure never aborts a scan
• Stdout and stderr terminal capabilities handled independently (redirected streams stay plain)

Clearer end-of-scan assessment (CLI)

• Overall priority and recommended next step aligned with the HTML assessment
• Installation review uses GroupInstallations (independent installs and versions remain visible)
• Windows hosts no longer show Linux dpkg/apk package-DB warnings
• Investigation statuses humanized; process completion still ≠ clearance

HTML / errors / tests

• :focus-visible outlines on collapsible sections
• Clearer multi-install mixed patch-level executive detail
• ACCESS_DENIED remediation for failed report writes
• Console/HTML phrase regressions, overwrite OUTPUT_EXISTS status JSON checks, and built-binary version / doctor smoke

Explicitly out of scope for v2.7.4

• New CTI findings, signed IOC packs, or additional compromise-detection capabilities
• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• New host discovery features
• Exit-code / status-JSON / fleet CSV schema changes
• Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.7.3

• OS-aware no-PHP reporting; enterprise quiet/status JSON / PSADT–Intune–GPO deployment contracts; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Missing evidence is not a negative finding; active HTTP-serving SAPI is still not attested
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS
• Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED

See also

• PR assets: pr-assets/v2.7.4-ux/
• UNDERSTANDING-REPORTS.md
• EXIT-CODES-AND-DEPLOYMENT.md
• Index: RELEASE-NOTES.md

PHP2Shell v2.7.3

PHP2Shell v2.7.3

Published: 25 October 2026
Tag: v2.7.3

Patch release: OS-aware no-PHP detection reporting and HTML usability correcting misleading v2.7.2 inventory messaging on hosts without PHP. Does not overwrite v2.7.2 (or earlier) release assets. No new scan features, CTI packs, or vulnerability-threshold changes.

Field validation: Automated regression tests and CI are green. Re-test on the original Windows machine that produced the v2.7.2 no-PHP inventory confusion is NOT TESTED (outstanding) — do not record that scenario as PASS.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.3 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

No-PHP reporting (OS-aware)

• Distinguish no PHP within completed applicable inventory from incomplete discovery, PHP evidence without a comparable version, and assessable PHP installations
• When applicable discovery completes with no PHP evidence: prominent “No PHP detected within scan coverage”, 0 installations, no PHP-specific remediation spam — still not a claim that the host is PHP-free, patched, or uncompromised
• Windows does not warn about missing Linux dpkg/apk/RPM package databases; unsupported packaging on Linux remains a soft coverage note; genuine Windows gaps (PATH/filesystem, processes, IIS ACCESS_DENIED / UNAVAILABLE) stay visible
• Scanner execution / exit codes and status JSON remain independent of PHP detection outcomes
• Additive summary semantics: NO_PHP_DETECTED_WITHIN_SCAN_COVERAGE, NO_PHP_SPECIFIC_REMEDIATION_IDENTIFIED (machine vulnerability_status schema preserved for empty comparable versions)

HTML / console usability

• Cleaner executive cards and next steps for no-PHP and incomplete-inventory cases
• Consistent human labels across CLI, HTML, CSV summary rows, and summary.* JSON fields

Explicitly out of scope for v2.7.3

• New CTI findings, signed IOC packs, or additional compromise-detection capabilities
• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• New host discovery features beyond reporting/usability corrections
• Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.7.2

• Enterprise QA posture, CVE-2026-115560 informational advisory assessment, Apache-2.0, legacy Windows artifact, exit-code / quiet status contract

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• “No PHP detected within scan coverage” is not proof PHP is absent elsewhere (custom paths, containers, offline images)
• Missing evidence is not a negative finding; active HTTP-serving SAPI is still not attested
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS

See also

• UNDERSTANDING-REPORTS.md
• Field retest notes: FIELD-TEST-V2.7.3-NO-PHP.md
• Index: RELEASE-NOTES.md

PHP2Shell v2.7.2

PHP2Shell v2.7.2

Published: 24 October 2026
Tag: v2.7.2

Stabilization release: enterprise QA for vulnerability assessment accuracy, console/HTML usability, WAF/status integrity, Apache-2.0 licensing, and distribution-readiness documentation — including informational CVE-2026-115560 assessment on top of v2.7.1. Does not overwrite v2.7.1 (or earlier) release assets.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.2 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

Enterprise QA and assessment accuracy

• Humanized console summary; patch-first HTML executive cards; PHP lifecycle notes; optional IR cards only when investigation applies (after recommended next steps)
• Prerelease / glued RC versions are not auto-approved as patched
• CVE-2026-115560: observe session.serialize_handler with session.upload_progress.enabled (static php.ini text only); conservative Additional Advisories statuses; no invented fixed versions; does not alter CVE-2026-109618 / CVE-2026-109619 thresholds (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• Bare inventories without php.ini evidence do not emit a misleading Additional Advisories banner; 115560 findings do not alone force exit code 2

WAF and status integrity

• Cloudflare WAF: RuleID / ruleId / rule_id allowlist matching; truncated or partially parsed JSONL → incomplete (TRUNCATED / UNAVAILABLE), not “complete”
• Status JSON: status_json_written + HTML-sibling fallbacks so OUTPUT_WRITE_FAILED is machine-detectable for Intune/PSADT

Licensing and release integrity

• Apache License 2.0 applied (LICENSE); prior LICENSE.proposed placeholder removed
• Legacy Windows build verifies Go 1.20.14 archive SHA-256 (including cache); release workflow binds workflow_dispatch publishes to the named tag commit

Documentation

• Understanding Reports; Intune / GPO / report-collection guides; Authenticode plan; README Quick Start without --quiet for interactive first runs
• PSADT reference: preserves scanner exit 0/1/2, stale-report guard, status validation

Preserved from v2.7.1

• IR accuracy, Cloudflare WAF ingest, Windows legacy artifact, exit-code / quiet status line contract

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Missing evidence is not a negative finding; active HTTP-serving SAPI is still not attested
• Vendor backports require separate verification
• Windows Server 2012 R2: legacy EXE for testing; not production-validated across all environments — see WINDOWS-LEGACY-2012R2.md
• Legacy Go 1.20.14 is end-of-support — prefer the standard Windows build on Win10 / Server 2016+
• Binaries remain unsigned (SmartScreen / application control may apply); verify SHA256SUMS
• Intune / GPO guides are reference designs — live tenant/domain field validation is customer-specific
• Standard Intune Win32 app deployment does not cover Windows Server

Out of scope for v2.7.2

• New WAF vendors, general-purpose PHP CVE scanning, invented CVE-2026-115560 fixed builds
• Authenticode / notarization (tracked for a later public-distribution milestone)
• Built-in cloud upload / mandatory report collection service

PHP2Shell v2.7.1

PHP2Shell v2.7.1

Published: 22 October 2026
Tag: v2.7.1

Calif-aligned compromise-investigation accuracy, offline Cloudflare WAF evidence, Windows Server 2012 R2 legacy artifact (runtime unverified until field-confirmed), and enterprise deployment diagnostics on top of v2.7.0. Does not overwrite v2.7.0 (or earlier) release assets.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.1 (and (legacy) for the legacy Windows EXE).

What is new

IR accuracy and evidence semantics

• SAPI-aware investigation reporting for configured mod_php / PHP-FPM / CGI / LiteSpeed / IIS hints — never claims verified active HTTP runtime; does not imply PHP-FPM is safe
• Explicit coverage when HTTP request-body / form-field / multipart metadata is unavailable from ordinary access logs
• Clear separation of long request-target length vs large bodies vs unusual form-field names vs multipart nesting
• Warnings that successful in-process exploitation may produce neither a crash nor a suspicious child process
• Stronger OBSERVED≠EFFECTIVE labelling for whitelisted php.ini mitigation-related settings
• Investigation evidence-source availability distinguishing REQUESTED_UNAVAILABLE from completed NO_MATCHES_IN_SCOPE

Offline Cloudflare WAF ingestion

• --waf-log for Cloudflare Logpush firewall_events JSONL (documented fields only)
• High-confidence leads only for allowlisted php2shell / Anomalous Execution RuleIDs
• Weak heuristic for query-string presence of PHP_SESSION_UPLOAD_PROGRESS (value not retained)
• Block/challenge/log actions are exploitation-attempt assists only — never successful compromise; WAF alone never sets possible-compromise
• Does not invent Content-Length or multipart nesting (absent from this schema)
• Bounds: ≤32 MiB/file, ≤8 files, ≤50 000 events; ClientIP not retained in findings

Windows Server 2012 R2 (legacy artifact)

• php2shell-windows-legacy-amd64.exe built with Go 1.20.14 (last Go that runs on Server 2012 R2); primary php2shell-windows-amd64.exe remains on the current Go toolchain and is not downgraded
• Startup OS gate: standard build refuses Windows < 10 with instructions to use the legacy EXE
• Runtime compatibility on a real Server 2012 R2 host is not production-validated in this release — treat as available for field testing; see WINDOWS-LEGACY-2012R2.md for Go 1.20 end-of-support security implications and the field checklist
• Same scanner source / CLI / HTML+CSV / exit-code semantics as the primary build where the OS allows

Deployment diagnostics and exit-code contract

• Sibling *.status.json execution status (php2shell-execution-status/v1), --status-json, --accept-incomplete
• --quiet still emits errors and a one-line status summary on stderr
• Absent IIS / non-dpkg Linux package DB no longer force exit 2 via false UNAVAILABLE
• Guide: EXIT-CODES-AND-DEPLOYMENT.md; PSADT reference under deploy/PSADT-PHP2Shell-Reference.ps1
• Exit 0 = reports written; 2 = reports written with incomplete coverage (still upload-eligible); 1 = fatal

Preserved from v2.7.0

• Offline access/error-log, process telemetry, and webroot metadata investigation
• Independent exploitation-attempt / possible-compromise / coverage statuses
• Fleet CSV v3; signed indicator packs unchanged
• Read-only local scan; no PHP execution; no automatic remediation or customer data upload

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Missing evidence is not a negative finding; WAF alone never establishes possible compromise
• Active HTTP-serving SAPI is still not attested
• Windows Server 2012 R2: legacy EXE provided for testing; do not claim production-validated 2012 R2 support until the field checklist is signed off
• Legacy Go 1.20.14 toolchain is end-of-support — prefer the standard Windows build on Win10 / Server 2016+
• Binaries remain unsigned (SmartScreen / application control may apply)

Out of scope for v2.7.1

• IIS long request-target parity and FrankenPHP process parents (tracked separately)
• Additional WAF vendors / schemas without verified fixtures
• Automatic customer upload / Intune blob transfer (deployment wrappers own upload)
• Authenticode / notarization

PHP2Shell v2.7.0

PHP2Shell v2.7.0

Published: 22 October 2026
Tag: v2.7.0

Evidence-based compromise investigation assist: offline access/error-log review, offline process/EDR telemetry, passive webroot metadata investigation, cross-source temporal correlation, and independent IR statuses — in addition to PHP discovery and patch assessment from v2.6.0. Does not overwrite v2.6.0 (or earlier) release assets.

Downloads

• php2shell-windows-amd64.zip
• php2shell-linux-amd64.tar.gz
• php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience builds)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.0.

What is new

HTTP access-log investigation

• Bounded offline --access-log review inside --investigate-from / --investigate-to (default floor 2026-10-17 UTC when investigating)
• Long POST request-target heuristic (≥2048 characters of URI path/query as logged) — measures request-target length only, never request-body size
• Contributes to independent exploitation-attempt status (NOT_ASSESSED / NO_MATCHES_IN_SCOPE / SUSPECTED_ATTEMPTS_REVIEW)

PHP / Apache error-log investigation

• Bounded --error-log review (≤32 MiB each)
• Research-backed patterns (e.g. PHP Fatal memory exhausted in Unknown on line 0; Apache child segfault / AH00052)
• Memory errors or crashes alone are not successful exploitation or host compromise

Offline process / EDR telemetry

• Repeatable --process-telemetry for offline exports only (≤32 MiB each, ≤8 files, ≤50 000 events)
• Supported formats: MDE DeviceProcessEvents CSV, Sysmon Event ID 1 CSV, Linux auditd EXECVE text, Elastic ECS process JSONL
• No live EDR APIs, credentials, or uploads
• Suspicious web/PHP parent→child relationship leads (behavioral; not confirmed compromise)
• Ordinary admin shells (e.g. explorer→cmd) are not treated as compromise
• Command lines redacted to classification tokens; entity/report IDs retained for trace-back

Passive webroot metadata investigation

• When --webroot is supplied during investigation: metadata-only walk (depth≤8, ≤25 000 entries, symlinks skipped, contents never read)
• Path location context (PHP under upload-like paths; unusual/double extensions) vs timestamp evidence (birth/mtime in window)
• Historical CMS files with both timestamps outside the window produce no leads
• In-window birth still reported when mtime is old; mtime is never creation or execution
• Path context alone never flips POSSIBLE_COMPROMISE_REVIEW
• Webroot-only possible compromise is labeled low-confidence in HTML/CSV
• Not a webshell/eval content scanner; signed SHA-256 IOC hashing under --webroot unchanged

Cross-source correlation and independent statuses

• Temporal proximity (±15 minutes) among access, error, process, and webroot (birth-based) leads — proximity ≠ causality
• Independent axes: vulnerability / exploitation attempts / possible compromise / investigation coverage
• Never auto-CONFIRMED_COMPROMISE; never equate NO_MATCHES_IN_SCOPE or empty findings with a clean host
• Incomplete / missing inputs → NOT_ASSESSED or INCOMPLETE (not a negative clearance)

Fleet CSV v3

• Writers emit php2shell-fleet-csv/v3 with IR columns
• Offline rollup accepts v1–v3 and writes v3
• See CSV-SCHEMA.md

Preserved from v2.6.0

• Optional --deep-root Deep Discovery; expanded well-known paths
• Multi-install retention; --php-ini / --config-root
• Matching HTML + CSV pairs; IIS/Apache bounded inventory
• Passive, read-only scanning; discovered PHP never executed; no automatic customer upload

Security limitations (unchanged product rules)

• Not a clearance tool
• Active HTTP-serving SAPI not attested from config alone
• Vendor backports not independently verified
• First/last log/telemetry timestamps do not prove continuous coverage
• Binaries not code-signed; verify SHA256SUMS
• Licensing still pending (LICENSE.proposed is not an approved license)

Out of scope for v2.7.0

• RPM DB inventory; PHP lifecycle calendar; AWS IP packs as strong IOCs
• Generic webshell/eval content scanning; live EDR APIs; automatic remediation
• Full IIS/Apache merge simulation; Tomcat/Java scanning

Quick start

.\php2shell-windows-amd64.exe scan --quiet --output-dir C:\ProgramData\PHP2Shell\Reports
.\php2shell-windows-amd64.exe scan `
  --webroot 'E:\websites\prod\site' `
  --access-log 'C:\inetpub\logs\LogFiles\W3SVC1\u_ex261018.log' `
  --error-log 'C:\PHP\logs\php_errors.log' `
  --process-telemetry 'C:\Engagement\exports\DeviceProcessEvents.csv' `
  --investigate-from 2026-10-17 `
  --quiet --output-dir C:\ProgramData\PHP2Shell\Reports

./php2shell-linux-amd64 scan --quiet --output-dir "$HOME/.php2shell/reports"
./php2shell-linux-amd64 scan \
  --webroot /var/www/html \
  --access-log /var/log/nginx/access.log \
  --error-log /var/log/php8.3-fpm.log \
  --process-telemetry ./exports/auditd-execve.log \
  --investigate-from 2026-10-17 \
  --quiet --output-dir "$HOME/.php2shell/reports"

Index: RELEASE-NOTES.md. Investigation: COMPROMISE-INVESTIGATION.md. Field guide: FIELD-VALIDATION-2.7.0.md. Schema: CSV-SCHEMA.md. Advanced: ADVANCED-USAGE.md.

PHP2Shell v2.6.0

PHP2Shell v2.6.0

Published: 21 October 2026
Tag: v2.6.0

Optional Deep Discovery for consultant-authorized custom directories, plus expanded bounded well-known installation paths (WAMP/Laragon/tools; Remi/cPanel FPM; /usr/local/php* / /opt/php/*). Builds on v2.5.1 PATH/junction and multi-install work. Does not overwrite v2.5.1 (or earlier) release assets.

Downloads

• php2shell-windows-amd64.zip
• php2shell-linux-amd64.tar.gz
• php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience builds)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.6.0.

What is new

Optional --deep-root Deep Discovery

• Repeatable; off by default; standard discovery unchanged when omitted
• Recursive walk under authorized roots only (depth ≤ 6, ≤ 25 000 entries, ≤ 400 PHP-like binaries, ≤ 200 ini candidates, 90s wall-clock budget)
• Rejects UNC/network paths and filesystem volume roots (C:\, /, …)
• Directory junctions/symlinks followed only when the resolved target remains inside the authorized start directory; file symlinks never followed
• Discovers PHP binaries and php.ini-like names not visible via PATH/well-known roots
• Weaker evidence provenance than well-known/PATH/IIS/--config-root sources
• Truncation and permission gaps emit coverage TRUNCATED / INCOMPLETE (process exit 2 when the report pair is written) — empty results are not proof PHP is absent

Expanded well-known installation paths

Bounded, non-recursive globs (no drive-wide walk):

• Windows: WampServer / Wamp64, Laragon, and C:\tools\php layouts (alongside existing XAMPP / Program Files / AppData patterns)
• Linux: Remi and cPanel EasyApache php-fpm under sbin, /usr/local/php*, and /opt/php/* (alongside existing Plesk / Remi / cPanel bin patterns)

Odd or nested trees still belong under explicit --deep-root, not broader defaults.

Multi-installation and configuration

• Independent installs retained separately; current aliases merge only when content-corroborated
• Per-install patch thresholds; verified vs path-inferred vs unknown version preserved
• Configuration-only php.ini findings remain labelled (not version/runtime authority)
• --php-ini and --config-root from v2.5.1 preserved (shallow config-root vs deep recursive)

Reporting

• Matching HTML + CSV pair unchanged in shape; fleet CSV schema remains php2shell-fleet-csv/v2
• Deep Discovery coverage and limitations appear in coverage checks, warnings, and limitations_summary
• Installed ≠ configured ≠ actively serving HTTP (unchanged)

Security limitations (unchanged product rules)

• Deep Discovery is opt-in
• Discovered PHP binaries are never executed
• Active HTTP-serving runtimes are not automatically attested
• Unsearched locations may contain additional PHP installations
• Vendor security backports are not independently verified
• Absence of compromise indicators is not proof of a clean host
• No automatic network transmission or telemetry
• Licensing still pending (LICENSE.proposed is not an approved license)

Out of scope for v2.6.0

• Full RPM package database inventory
• Structured PHP support lifecycle calendar (planned later — see ROADMAP-2.7.0.md)
• Automatic full-disk scanning
• Tomcat/Java vulnerability scanning
• Automatic remediation

Quick start

.\php2shell-windows-amd64.exe scan --quiet --output-dir C:\ProgramData\PHP2Shell\Reports
# Authorized custom trees:
.\php2shell-windows-amd64.exe scan --deep-root 'C:\Temp\PHP' --deep-root 'E:\websites'

./php2shell-linux-amd64 scan --quiet --output-dir "$HOME/.php2shell/reports"
./php2shell-linux-amd64 scan --deep-root /opt --deep-root /srv/www

Prefer default scan first; add --deep-root only for known custom trees. Prefer --config-root when only a shallow install/conf.d layer is needed.

Index: RELEASE-NOTES.md. Schema: CSV-SCHEMA.md. Advanced: ADVANCED-USAGE.md.