PHP2Shell v2.7.5

PHP2Shell v2.7.5

Published: 25 October 2026
Tag: v2.7.5

Patch release: Unix PHP executable symlink discovery (bounded resolve, relevant unresolved-candidate reporting, alias path retention without duplicate installs). Preserves v2.7.4 detection classifications, exit codes, status JSON, CSV, and fleet consolidation. Does not overwrite v2.7.4 (or earlier) release assets. No nginx, PHP-FPM pool config, RPM/dnf package-DB, Docker, or broader Phase A/B/C discovery expansion in this release.

Field validation: Automated regression tests and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green on the merged symlink-discovery work (PR #32) and this finalize tip. Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix remains NOT TESTED (outstanding from v2.7.4) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.7.5 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

Unix PHP executable symlink discovery

• Resolve phpBin-named file symlink chains within an explicit hop budget (Homebrew Cellar aliases, /etc/alternatives chains, versioned php8.x / php-cgi / php-fpm PATH names)
• Inspect the resolved regular file only — never execute PHP or package managers
• Deduplicate installs by resolved path while retaining operator-facing aliases (via symlink / also_via_symlink)
• Windows file-symlink rejection (isSafeRegularFile) and directory reparse behaviour unchanged

Relevant unresolved candidates

• Permission-denied and over-budget symlink chains leave PHP_EXECUTABLE_CANDIDATE_UNRESOLVED_NOT_INSPECTED evidence
• Prevents a soft NO_PHP_DETECTED_WITHIN_SCAN_COVERAGE conclusion when a relevant PHP executable candidate could not be inspected
• Broken, circular, and non-regular targets stay silent (no incomplete-scan noise)

Explicitly out of scope for v2.7.5

• nginx / PHP-FPM pool configuration discovery
• RPM/yum/dnf (or other non-dpkg/apk) package inventory
• Docker / container image inventory
• Homebrew well-known path expansion beyond PATH + existing Linux globs
• Phase A no-PHP messaging redesign beyond the unresolved-candidate honesty fix above
• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• Exit-code / status-JSON / fleet CSV schema changes
• Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.7.4

• Console UX / reliability polish; OS-aware no-PHP reporting; enterprise quiet/status JSON / PSADT–Intune–GPO contracts; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Missing evidence is not a negative finding; absence of PHP findings is not proof a host is PHP-free
• Active HTTP-serving SAPI is still not attested
• PHP installations outside PATH, existing well-known globs, and operator --config-root / --deep-root remain undiscovered (bounded coverage — not complete host inventory)
• Deep Discovery still does not follow file symlinks as tree edges
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS
• Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED

See also

• Merged discovery work: PR #32 (fix/unix-php-symlink-discovery)
• UNDERSTANDING-REPORTS.md
• EXIT-CODES-AND-DEPLOYMENT.md
• Index: RELEASE-NOTES.md