PHP2Shell v2.8.2

PHP2Shell v2.8.2

Published: 27 October 2026
Tag: v2.8.2

Focused discovery correctness maintenance for confirmed WampServer inventory gaps reported against v2.8.1. Preserves CVE vulnerability thresholds, investigation/telemetry behaviour, active-runtime attestation limits, exit codes, HTML/CSV/status JSON, fleet CSV v3, and report schemas. Does not overwrite v2.8.1 (or earlier) release assets. Offline and read-only by default. No active exploitation, network probing, broad filesystem scanning, PHP binary execution, or unrelated discovery expansion.

Field validation: Automated unit/regression and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green on the discovery merge (PR #47 tip 75b077b / merge bf70ade) and this finalize tip. Synthetic ASERVER2-style WampServer fixture regressions PASS. Real-world ASERVER2 host re-scan remains NOT YET FIELD-VALIDATED for this release — do not treat the synthetic fixture as a substitute. Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix remains NOT TESTED (outstanding from earlier releases). Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.8.2 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0. See README / consultant install guide for unsigned-binary and endpoint-protection guidance (investigate detections first; no broad AV exclusions by default).

What is new

WampServer-style PHP version path inference

• Directory segments formatted as phpX.Y.Z (e.g. C:\wamp64\bin\php\php7.4.33\php.exe) are recognized in addition to bare X.Y.Z
• Inferred versions remain binary_path_inferred_version with provenance path_inferred and confidence MEDIUM
• Path-inferred versions are not verified binary metadata and are not proof of the active HTTP-serving runtime
• Marker-free binaries under these layouts can receive legacy/EOL patch review messaging when a comparable version is inferred — still requiring manual verification

Bounded WampServer configuration discovery

• Apache config roots expanded with bounded globs: C:\wamp64\bin\apache\*\conf, C:\wamp\bin\apache\*\conf (filepath.Glob only; not recursive host-wide scanning)
• Well-known php.ini patterns include C:\wamp64\bin\php\*\php.ini (alongside existing C:\wamp\...)
• Reuses existing Apache / php.ini parsers and coverage semantics
• Static configuration alone still does not verify an active web-serving PHP runtime

Clearer verified / inferred / unknown reporting

• Executive HTML, CLI summary, and binary_paths coverage distinguish:
  • verified binary metadata versions
  • path-inferred versions (MEDIUM; manual verification required)
  • candidates without comparable versions
• Path-inferred findings are not presented as confirmed installations or proven vulnerability exposure

Deduplication across discovery sources

• Apache handler binary follow-up skips re-inventory when the same PHP binary path is already recorded (e.g. well-known / PATH discovery)
• Handler/module configuration evidence is still recorded
• Install grouping and patch assessment stay one logical install tree / one row per distinct binary path

Honesty (required reading)

Observation	Means
Verified binary metadata	Text extracted from embedded/PE markers — still not proof the binary serves HTTP
Path-inferred (phpX.Y.Z / bare X.Y.Z)	Directory-derived inventory lead — MEDIUM confidence; requires manual verification
Apache / php.ini candidates	Configured paths only — not active runtime or effective settings attestation
Active web runtime	Remains unverified unless separately established; inventory never upgrades to “Verified” from path/config alone

Explicitly out of scope for v2.8.2

• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• New telemetry sources, investigation axes, CTI/IOC packs, or CISA KEV / Sigma-rule detection imports
• Active HTTP SAPI attestation (NOT_IMPLEMENTED unchanged)
• Report schema / exit-code / fleet CSV contract changes
• Broad recursive filesystem scanning or executing PHP binaries
• Unrelated well-known path expansion beyond the bounded WampServer roots above
• Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.8.1

• ReliaQuest / Unit 42–aligned investigation assists and confidence ladder
• Bounded nginx / PHP-FPM configuration discovery; Unix PHP symlink discovery; console UX; enterprise quiet/status JSON; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Path-inferred versions are inventory leads, not confirmed installs or proven exposure
• Missing evidence is not a negative finding; absence of PHP findings is not proof a host is PHP-free
• Active HTTP-serving SAPI is still not attested from path inference or Apache/php.ini inventory
• Custom drive letters / nonstandard Wamp layouts still need --config-root / --deep-root / --php-ini
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS (integrity vs published manifest, not independent publisher authentication)
• Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED
• Real ASERVER2 host validation after this publish remains an operator follow-up

See also

• Prior: v2.8.1 · v2.8.0
• Understanding reports: UNDERSTANDING-REPORTS.md