Skip to content

PHP2Shell v2.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Oct 17:09
v2.8.0
1ba4943
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PHP2Shell v2.8.0

Published: 25 October 2026
Tag: v2.8.0

Minor release: bounded nginx / PHP-FPM configuration discovery on Unix well-known paths, with LIVE_DOCKER lab validation (8/8). Preserves v2.7.5 detection classifications for CVE thresholds, exit codes, status JSON, CSV, and fleet consolidation. Does not overwrite v2.7.5 (or earlier) release assets. No Homebrew path expansion, RPM/dnf package-DB inventory, Docker/container runtime product discovery, or CTI/IOC packs in this release.

Field validation: Automated unit/layout/offline contracts and LIVE_DOCKER eight-scenario labs are green (validation merge PR #35; evidence tip 8746899 / Actions run 40211792925; preserved under docs/pr-assets/v2.8.0-nginx-fpm-live/). Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix remains NOT TESTED (outstanding from earlier releases) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

  • php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
  • php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
  • php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
  • php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.8.0 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

Bounded nginx / PHP-FPM configuration discovery

  • Read-only inventory of well-known nginx roots (/etc/nginx, /usr/local/etc/nginx, /usr/local/nginx/conf) and PHP-FPM pool roots (/etc/php/*/fpm/pool.d, /etc/php-fpm.d, /usr/local/etc/php-fpm.d, related seed php-fpm.conf paths)
  • Classify fastcgi_pass / upstream backends as local (Unix socket / loopback TCP), remote, ambiguous, or variable-unresolved — with skip/incomplete honesty when configs are unreadable or includes are blocked
  • Correlate identical local listen targets between nginx handlers and FPM pools when both are inspectable
  • Caps on file count, size, include depth, and symlink hops; no network connect, no DNS, no execution of PHP or package managers

Honesty (required reading)

  • nginx/FPM configuration correlation is never proof of the active HTTP-serving PHP runtime or its patch state
  • EffectiveWebRuntime remains NOT_VERIFIED when evidence comes from configuration alone
  • Remote FastCGI backends are reported as configuration candidates with incomplete coverage — they are not assessed as patched from a local binary
  • Missing or skipped configs are not a negative finding that the host is PHP-free

Explicitly out of scope for v2.8.0

  • Homebrew / non-well-known prefix expansion for nginx or FPM
  • RPM/yum/dnf (or other non-dpkg/apk) package inventory
  • Docker / container image or runtime inventory as a product feature
  • LiteSpeed / OpenResty-only stacks; Windows nginx
  • Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
  • Exit-code / status-JSON / fleet CSV schema changes
  • Authenticode signing (still unsigned + SHA256SUMS)
  • CTI / IOC packs

Preserved from v2.7.5

  • Unix PHP executable symlink discovery; console UX; OS-aware no-PHP reporting; enterprise quiet/status JSON / PSADT–Intune–GPO contracts; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

  • Process completion / exit 0 is not a vulnerability or compromise clearance
  • Missing evidence is not a negative finding; absence of PHP findings is not proof a host is PHP-free
  • Active HTTP-serving SAPI is still not attested from nginx/FPM config
  • Installations and configs outside PATH, existing well-known globs, and operator --config-root / --deep-root remain undiscovered (bounded coverage)
  • Variable-only fastcgi_pass and custom prefixes remain incomplete / unsupported
  • Vendor backports require separate verification
  • Binaries remain unsigned; verify SHA256SUMS
  • Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED

See also

Assets 15
Loading