Skip to content

PHP2Shell v2.7.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Oct 13:35
v2.7.3
0a97e98
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PHP2Shell v2.7.3

Published: 25 October 2026
Tag: v2.7.3

Patch release: OS-aware no-PHP detection reporting and HTML usability correcting misleading v2.7.2 inventory messaging on hosts without PHP. Does not overwrite v2.7.2 (or earlier) release assets. No new scan features, CTI packs, or vulnerability-threshold changes.

Field validation: Automated regression tests and CI are green. Re-test on the original Windows machine that produced the v2.7.2 no-PHP inventory confusion is NOT TESTED (outstanding) — do not record that scenario as PASS.

Downloads

  • php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
  • php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
  • php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
  • php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.3 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

No-PHP reporting (OS-aware)

  • Distinguish no PHP within completed applicable inventory from incomplete discovery, PHP evidence without a comparable version, and assessable PHP installations
  • When applicable discovery completes with no PHP evidence: prominent “No PHP detected within scan coverage”, 0 installations, no PHP-specific remediation spam — still not a claim that the host is PHP-free, patched, or uncompromised
  • Windows does not warn about missing Linux dpkg/apk/RPM package databases; unsupported packaging on Linux remains a soft coverage note; genuine Windows gaps (PATH/filesystem, processes, IIS ACCESS_DENIED / UNAVAILABLE) stay visible
  • Scanner execution / exit codes and status JSON remain independent of PHP detection outcomes
  • Additive summary semantics: NO_PHP_DETECTED_WITHIN_SCAN_COVERAGE, NO_PHP_SPECIFIC_REMEDIATION_IDENTIFIED (machine vulnerability_status schema preserved for empty comparable versions)

HTML / console usability

  • Cleaner executive cards and next steps for no-PHP and incomplete-inventory cases
  • Consistent human labels across CLI, HTML, CSV summary rows, and summary.* JSON fields

Explicitly out of scope for v2.7.3

  • New CTI findings, signed IOC packs, or additional compromise-detection capabilities
  • Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
  • New host discovery features beyond reporting/usability corrections
  • Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.7.2

  • Enterprise QA posture, CVE-2026-115560 informational advisory assessment, Apache-2.0, legacy Windows artifact, exit-code / quiet status contract

Limitations (read before deploying)

  • Process completion / exit 0 is not a vulnerability or compromise clearance
  • “No PHP detected within scan coverage” is not proof PHP is absent elsewhere (custom paths, containers, offline images)
  • Missing evidence is not a negative finding; active HTTP-serving SAPI is still not attested
  • Vendor backports require separate verification
  • Binaries remain unsigned; verify SHA256SUMS

See also

Assets 15
Loading