Skip to content

PHP2Shell v2.7.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 15:09
v2.7.2
b6fd065
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PHP2Shell v2.7.2

Published: 24 October 2026
Tag: v2.7.2

Stabilization release: enterprise QA for vulnerability assessment accuracy, console/HTML usability, WAF/status integrity, Apache-2.0 licensing, and distribution-readiness documentation — including informational CVE-2026-115560 assessment on top of v2.7.1. Does not overwrite v2.7.1 (or earlier) release assets.

Downloads

  • php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
  • php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
  • php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
  • php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.2 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

Enterprise QA and assessment accuracy

  • Humanized console summary; patch-first HTML executive cards; PHP lifecycle notes; optional IR cards only when investigation applies (after recommended next steps)
  • Prerelease / glued RC versions are not auto-approved as patched
  • CVE-2026-115560: observe session.serialize_handler with session.upload_progress.enabled (static php.ini text only); conservative Additional Advisories statuses; no invented fixed versions; does not alter CVE-2026-109618 / CVE-2026-109619 thresholds (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
  • Bare inventories without php.ini evidence do not emit a misleading Additional Advisories banner; 115560 findings do not alone force exit code 2

WAF and status integrity

  • Cloudflare WAF: RuleID / ruleId / rule_id allowlist matching; truncated or partially parsed JSONL → incomplete (TRUNCATED / UNAVAILABLE), not “complete”
  • Status JSON: status_json_written + HTML-sibling fallbacks so OUTPUT_WRITE_FAILED is machine-detectable for Intune/PSADT

Licensing and release integrity

  • Apache License 2.0 applied (LICENSE); prior LICENSE.proposed placeholder removed
  • Legacy Windows build verifies Go 1.20.14 archive SHA-256 (including cache); release workflow binds workflow_dispatch publishes to the named tag commit

Documentation

  • Understanding Reports; Intune / GPO / report-collection guides; Authenticode plan; README Quick Start without --quiet for interactive first runs
  • PSADT reference: preserves scanner exit 0/1/2, stale-report guard, status validation

Preserved from v2.7.1

  • IR accuracy, Cloudflare WAF ingest, Windows legacy artifact, exit-code / quiet status line contract

Limitations (read before deploying)

  • Process completion / exit 0 is not a vulnerability or compromise clearance
  • Missing evidence is not a negative finding; active HTTP-serving SAPI is still not attested
  • Vendor backports require separate verification
  • Windows Server 2012 R2: legacy EXE for testing; not production-validated across all environments — see WINDOWS-LEGACY-2012R2.md
  • Legacy Go 1.20.14 is end-of-support — prefer the standard Windows build on Win10 / Server 2016+
  • Binaries remain unsigned (SmartScreen / application control may apply); verify SHA256SUMS
  • Intune / GPO guides are reference designs — live tenant/domain field validation is customer-specific
  • Standard Intune Win32 app deployment does not cover Windows Server

Out of scope for v2.7.2

  • New WAF vendors, general-purpose PHP CVE scanning, invented CVE-2026-115560 fixed builds
  • Authenticode / notarization (tracked for a later public-distribution milestone)
  • Built-in cloud upload / mandatory report collection service
Assets 15
Loading