PHP2Shell v2.7.1

PHP2Shell v2.7.1

Published: 22 October 2026
Tag: v2.7.1

Calif-aligned compromise-investigation accuracy, offline Cloudflare WAF evidence, Windows Server 2012 R2 legacy artifact (runtime unverified until field-confirmed), and enterprise deployment diagnostics on top of v2.7.0. Does not overwrite v2.7.0 (or earlier) release assets.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.1 (and (legacy) for the legacy Windows EXE).

What is new

IR accuracy and evidence semantics

• SAPI-aware investigation reporting for configured mod_php / PHP-FPM / CGI / LiteSpeed / IIS hints — never claims verified active HTTP runtime; does not imply PHP-FPM is safe
• Explicit coverage when HTTP request-body / form-field / multipart metadata is unavailable from ordinary access logs
• Clear separation of long request-target length vs large bodies vs unusual form-field names vs multipart nesting
• Warnings that successful in-process exploitation may produce neither a crash nor a suspicious child process
• Stronger OBSERVED≠EFFECTIVE labelling for whitelisted php.ini mitigation-related settings
• Investigation evidence-source availability distinguishing REQUESTED_UNAVAILABLE from completed NO_MATCHES_IN_SCOPE

Offline Cloudflare WAF ingestion

• --waf-log for Cloudflare Logpush firewall_events JSONL (documented fields only)
• High-confidence leads only for allowlisted php2shell / Anomalous Execution RuleIDs
• Weak heuristic for query-string presence of PHP_SESSION_UPLOAD_PROGRESS (value not retained)
• Block/challenge/log actions are exploitation-attempt assists only — never successful compromise; WAF alone never sets possible-compromise
• Does not invent Content-Length or multipart nesting (absent from this schema)
• Bounds: ≤32 MiB/file, ≤8 files, ≤50 000 events; ClientIP not retained in findings

Windows Server 2012 R2 (legacy artifact)

• php2shell-windows-legacy-amd64.exe built with Go 1.20.14 (last Go that runs on Server 2012 R2); primary php2shell-windows-amd64.exe remains on the current Go toolchain and is not downgraded
• Startup OS gate: standard build refuses Windows < 10 with instructions to use the legacy EXE
• Runtime compatibility on a real Server 2012 R2 host is not production-validated in this release — treat as available for field testing; see WINDOWS-LEGACY-2012R2.md for Go 1.20 end-of-support security implications and the field checklist
• Same scanner source / CLI / HTML+CSV / exit-code semantics as the primary build where the OS allows

Deployment diagnostics and exit-code contract

• Sibling *.status.json execution status (php2shell-execution-status/v1), --status-json, --accept-incomplete
• --quiet still emits errors and a one-line status summary on stderr
• Absent IIS / non-dpkg Linux package DB no longer force exit 2 via false UNAVAILABLE
• Guide: EXIT-CODES-AND-DEPLOYMENT.md; PSADT reference under deploy/PSADT-PHP2Shell-Reference.ps1
• Exit 0 = reports written; 2 = reports written with incomplete coverage (still upload-eligible); 1 = fatal

Preserved from v2.7.0

• Offline access/error-log, process telemetry, and webroot metadata investigation
• Independent exploitation-attempt / possible-compromise / coverage statuses
• Fleet CSV v3; signed indicator packs unchanged
• Read-only local scan; no PHP execution; no automatic remediation or customer data upload

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Missing evidence is not a negative finding; WAF alone never establishes possible compromise
• Active HTTP-serving SAPI is still not attested
• Windows Server 2012 R2: legacy EXE provided for testing; do not claim production-validated 2012 R2 support until the field checklist is signed off
• Legacy Go 1.20.14 toolchain is end-of-support — prefer the standard Windows build on Win10 / Server 2016+
• Binaries remain unsigned (SmartScreen / application control may apply)

Out of scope for v2.7.1

• IIS long request-target parity and FrankenPHP process parents (tracked separately)
• Additional WAF vendors / schemas without verified fixtures
• Automatic customer upload / Intune blob transfer (deployment wrappers own upload)
• Authenticode / notarization