Skip to content

PHP2Shell v2.7.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Oct 14:16
v2.7.4
abce2d6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PHP2Shell v2.7.4

Published: 25 October 2026
Tag: v2.7.4

Patch release: console UX and operational reliability for ordinary IT administrators and enterprise deployments. Preserves v2.7.3 detection classifications, exit codes, status JSON, CSV, and fleet consolidation. Does not overwrite v2.7.3 (or earlier) release assets. No new scanning features, CVEs, WAF/DFIR integrations, or threshold changes.

Field validation: Automated regression tests and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green. Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix is NOT TESTED (outstanding) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

  • php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
  • php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
  • php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
  • php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.4 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

Windows console compatibility

  • Explicit --no-color (also respects NO_COLOR); does not change the --quiet automation contract
  • Best-effort Windows Virtual Terminal enablement with safe plain-text fallback (Server 2012 R2 / legacy conhost) — VT failure never aborts a scan
  • Stdout and stderr terminal capabilities handled independently (redirected streams stay plain)

Clearer end-of-scan assessment (CLI)

  • Overall priority and recommended next step aligned with the HTML assessment
  • Installation review uses GroupInstallations (independent installs and versions remain visible)
  • Windows hosts no longer show Linux dpkg/apk package-DB warnings
  • Investigation statuses humanized; process completion still ≠ clearance

HTML / errors / tests

  • :focus-visible outlines on collapsible sections
  • Clearer multi-install mixed patch-level executive detail
  • ACCESS_DENIED remediation for failed report writes
  • Console/HTML phrase regressions, overwrite OUTPUT_EXISTS status JSON checks, and built-binary version / doctor smoke

Explicitly out of scope for v2.7.4

  • New CTI findings, signed IOC packs, or additional compromise-detection capabilities
  • Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
  • New host discovery features
  • Exit-code / status-JSON / fleet CSV schema changes
  • Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.7.3

  • OS-aware no-PHP reporting; enterprise quiet/status JSON / PSADT–Intune–GPO deployment contracts; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

  • Process completion / exit 0 is not a vulnerability or compromise clearance
  • Missing evidence is not a negative finding; active HTTP-serving SAPI is still not attested
  • Vendor backports require separate verification
  • Binaries remain unsigned; verify SHA256SUMS
  • Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED

See also

Assets 15
Loading