PHP2Shell v2.7.0

PHP2Shell v2.7.0

Published: 22 October 2026
Tag: v2.7.0

Evidence-based compromise investigation assist: offline access/error-log review, offline process/EDR telemetry, passive webroot metadata investigation, cross-source temporal correlation, and independent IR statuses — in addition to PHP discovery and patch assessment from v2.6.0. Does not overwrite v2.6.0 (or earlier) release assets.

Downloads

• php2shell-windows-amd64.zip
• php2shell-linux-amd64.tar.gz
• php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience builds)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.0.

What is new

HTTP access-log investigation

• Bounded offline --access-log review inside --investigate-from / --investigate-to (default floor 2026-10-17 UTC when investigating)
• Long POST request-target heuristic (≥2048 characters of URI path/query as logged) — measures request-target length only, never request-body size
• Contributes to independent exploitation-attempt status (NOT_ASSESSED / NO_MATCHES_IN_SCOPE / SUSPECTED_ATTEMPTS_REVIEW)

PHP / Apache error-log investigation

• Bounded --error-log review (≤32 MiB each)
• Research-backed patterns (e.g. PHP Fatal memory exhausted in Unknown on line 0; Apache child segfault / AH00052)
• Memory errors or crashes alone are not successful exploitation or host compromise

Offline process / EDR telemetry

• Repeatable --process-telemetry for offline exports only (≤32 MiB each, ≤8 files, ≤50 000 events)
• Supported formats: MDE DeviceProcessEvents CSV, Sysmon Event ID 1 CSV, Linux auditd EXECVE text, Elastic ECS process JSONL
• No live EDR APIs, credentials, or uploads
• Suspicious web/PHP parent→child relationship leads (behavioral; not confirmed compromise)
• Ordinary admin shells (e.g. explorer→cmd) are not treated as compromise
• Command lines redacted to classification tokens; entity/report IDs retained for trace-back

Passive webroot metadata investigation

• When --webroot is supplied during investigation: metadata-only walk (depth≤8, ≤25 000 entries, symlinks skipped, contents never read)
• Path location context (PHP under upload-like paths; unusual/double extensions) vs timestamp evidence (birth/mtime in window)
• Historical CMS files with both timestamps outside the window produce no leads
• In-window birth still reported when mtime is old; mtime is never creation or execution
• Path context alone never flips POSSIBLE_COMPROMISE_REVIEW
• Webroot-only possible compromise is labeled low-confidence in HTML/CSV
• Not a webshell/eval content scanner; signed SHA-256 IOC hashing under --webroot unchanged

Cross-source correlation and independent statuses

• Temporal proximity (±15 minutes) among access, error, process, and webroot (birth-based) leads — proximity ≠ causality
• Independent axes: vulnerability / exploitation attempts / possible compromise / investigation coverage
• Never auto-CONFIRMED_COMPROMISE; never equate NO_MATCHES_IN_SCOPE or empty findings with a clean host
• Incomplete / missing inputs → NOT_ASSESSED or INCOMPLETE (not a negative clearance)

Fleet CSV v3

• Writers emit php2shell-fleet-csv/v3 with IR columns
• Offline rollup accepts v1–v3 and writes v3
• See CSV-SCHEMA.md

Preserved from v2.6.0

• Optional --deep-root Deep Discovery; expanded well-known paths
• Multi-install retention; --php-ini / --config-root
• Matching HTML + CSV pairs; IIS/Apache bounded inventory
• Passive, read-only scanning; discovered PHP never executed; no automatic customer upload

Security limitations (unchanged product rules)

• Not a clearance tool
• Active HTTP-serving SAPI not attested from config alone
• Vendor backports not independently verified
• First/last log/telemetry timestamps do not prove continuous coverage
• Binaries not code-signed; verify SHA256SUMS
• Licensing still pending (LICENSE.proposed is not an approved license)

Out of scope for v2.7.0

• RPM DB inventory; PHP lifecycle calendar; AWS IP packs as strong IOCs
• Generic webshell/eval content scanning; live EDR APIs; automatic remediation
• Full IIS/Apache merge simulation; Tomcat/Java scanning

Quick start

.\php2shell-windows-amd64.exe scan --quiet --output-dir C:\ProgramData\PHP2Shell\Reports
.\php2shell-windows-amd64.exe scan `
  --webroot 'E:\websites\prod\site' `
  --access-log 'C:\inetpub\logs\LogFiles\W3SVC1\u_ex261018.log' `
  --error-log 'C:\PHP\logs\php_errors.log' `
  --process-telemetry 'C:\Engagement\exports\DeviceProcessEvents.csv' `
  --investigate-from 2026-10-17 `
  --quiet --output-dir C:\ProgramData\PHP2Shell\Reports

./php2shell-linux-amd64 scan --quiet --output-dir "$HOME/.php2shell/reports"
./php2shell-linux-amd64 scan \
  --webroot /var/www/html \
  --access-log /var/log/nginx/access.log \
  --error-log /var/log/php8.3-fpm.log \
  --process-telemetry ./exports/auditd-execve.log \
  --investigate-from 2026-10-17 \
  --quiet --output-dir "$HOME/.php2shell/reports"

Index: RELEASE-NOTES.md. Investigation: COMPROMISE-INVESTIGATION.md. Field guide: FIELD-VALIDATION-2.7.0.md. Schema: CSV-SCHEMA.md. Advanced: ADVANCED-USAGE.md.