PHP2Shell v2.6.0

PHP2Shell v2.6.0

Published: 21 October 2026
Tag: v2.6.0

Optional Deep Discovery for consultant-authorized custom directories, plus expanded bounded well-known installation paths (WAMP/Laragon/tools; Remi/cPanel FPM; /usr/local/php* / /opt/php/*). Builds on v2.5.1 PATH/junction and multi-install work. Does not overwrite v2.5.1 (or earlier) release assets.

Downloads

• php2shell-windows-amd64.zip
• php2shell-linux-amd64.tar.gz
• php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience builds)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.6.0.

What is new

Optional --deep-root Deep Discovery

• Repeatable; off by default; standard discovery unchanged when omitted
• Recursive walk under authorized roots only (depth ≤ 6, ≤ 25 000 entries, ≤ 400 PHP-like binaries, ≤ 200 ini candidates, 90s wall-clock budget)
• Rejects UNC/network paths and filesystem volume roots (C:\, /, …)
• Directory junctions/symlinks followed only when the resolved target remains inside the authorized start directory; file symlinks never followed
• Discovers PHP binaries and php.ini-like names not visible via PATH/well-known roots
• Weaker evidence provenance than well-known/PATH/IIS/--config-root sources
• Truncation and permission gaps emit coverage TRUNCATED / INCOMPLETE (process exit 2 when the report pair is written) — empty results are not proof PHP is absent

Expanded well-known installation paths

Bounded, non-recursive globs (no drive-wide walk):

• Windows: WampServer / Wamp64, Laragon, and C:\tools\php layouts (alongside existing XAMPP / Program Files / AppData patterns)
• Linux: Remi and cPanel EasyApache php-fpm under sbin, /usr/local/php*, and /opt/php/* (alongside existing Plesk / Remi / cPanel bin patterns)

Odd or nested trees still belong under explicit --deep-root, not broader defaults.

Multi-installation and configuration

• Independent installs retained separately; current aliases merge only when content-corroborated
• Per-install patch thresholds; verified vs path-inferred vs unknown version preserved
• Configuration-only php.ini findings remain labelled (not version/runtime authority)
• --php-ini and --config-root from v2.5.1 preserved (shallow config-root vs deep recursive)

Reporting

• Matching HTML + CSV pair unchanged in shape; fleet CSV schema remains php2shell-fleet-csv/v2
• Deep Discovery coverage and limitations appear in coverage checks, warnings, and limitations_summary
• Installed ≠ configured ≠ actively serving HTTP (unchanged)

Security limitations (unchanged product rules)

• Deep Discovery is opt-in
• Discovered PHP binaries are never executed
• Active HTTP-serving runtimes are not automatically attested
• Unsearched locations may contain additional PHP installations
• Vendor security backports are not independently verified
• Absence of compromise indicators is not proof of a clean host
• No automatic network transmission or telemetry
• Licensing still pending (LICENSE.proposed is not an approved license)

Out of scope for v2.6.0

• Full RPM package database inventory
• Structured PHP support lifecycle calendar (planned later — see ROADMAP-2.7.0.md)
• Automatic full-disk scanning
• Tomcat/Java vulnerability scanning
• Automatic remediation

Quick start

.\php2shell-windows-amd64.exe scan --quiet --output-dir C:\ProgramData\PHP2Shell\Reports
# Authorized custom trees:
.\php2shell-windows-amd64.exe scan --deep-root 'C:\Temp\PHP' --deep-root 'E:\websites'

./php2shell-linux-amd64 scan --quiet --output-dir "$HOME/.php2shell/reports"
./php2shell-linux-amd64 scan --deep-root /opt --deep-root /srv/www

Prefer default scan first; add --deep-root only for known custom trees. Prefer --config-root when only a shallow install/conf.d layer is needed.

Index: RELEASE-NOTES.md. Schema: CSV-SCHEMA.md. Advanced: ADVANCED-USAGE.md.