Skip to content

Releases: SirjanSingh/php2shell-check

Release list

v0.2.0: restart-awareness, rules, SSH fleet check, CVE-2026-115560 scan

v0.2.0: restart-awareness, rules, SSH fleet check, CVE-2026-115560 scan Latest
Latest

Choose a tag to compare

View all tags
@SirjanSingh SirjanSingh released this 28 Oct 20:48
v0.2.0
0a6f4f1

pipx install php2shell-check (or pip install -U php2shell-check)

Is the patch actually running? check now looks at /proc for php-fpm / mod_php workers still executing code that was replaced on disk. A package upgrade fixes the files, not the processes, so a host can look patched and still run the old code. That counts as a failure even when the version on disk is fixed.

New in this release

  • rules: ready-to-paste ModSecurity, Sigma and Suricata rules built from the scan-logs indicators. Detect-only by default; --block only for the two high-confidence rules.
  • check --ssh-hosts FILE: fleet check over SSH for hosts you hold keys for. Key auth only, one fixed read-only script, nothing written on the host.
  • scan-code PATH... and a check note for CVE-2026-115560, the session-handler issue PHP disclosed on 2026-10-23. The 2026-10-21 updates do not fix it and there is no fixed release yet; PHP calls the setup unlikely. scan-code looks for a runtime ini_set('session.serialize_handler', 'php'); check reports session.upload_progress.enabled even on patched installs.
  • --fail-on high|medium|low|none on check, scan-logs, scan-docker and scan-code.
  • Config-posture report (session.upload_progress.*, post_max_size, memory_limit), reported as exposure reduction only, never as a fix.

Still defensive and local: no URL mode, no exploit traffic. Access-log scans are not an all-clear, since bodies are rarely logged, and the generated rules are not validated against a live engine, so run them detect-only first.

Full list in CHANGELOG.md.

Assets 2
Loading

php2shell-check v0.1.0

php2shell-check v0.1.0

Choose a tag to compare

View all tags
@SirjanSingh SirjanSingh released this 25 Oct 21:22
v0.1.0
64c36d1

First release on PyPI (pipx install php2shell-check).

Added

  • check (detector) and harden (preventer) for the PHP2Shell RCE flaws
    CVE-2026-109618 and CVE-2026-109619.
  • check --inventory FILE — offline fleet check from a list of label version
    lines (no network, no SSH).
  • check --sarif / scan-logs --sarif — SARIF 2.1.0 output for GitHub code
    scanning.
  • scan-docker — assess PHP base-image tags in Dockerfiles/compose files, and
    (with --running) read PHP versions from running containers. Branch-only tags
    (e.g. php:8.1, php:8.4) are classified distinctly from pinned tags.
  • scan-logs — read-only detection of PHP2Shell exploitation attempts in web
    and PHP logs, using vendor-published indicators (each tagged with its source).
  • Packaging: pip/pipx installable with a php2shell-check entry point;
    version single-sourced from the module; SPDX license metadata.
  • Automated PyPI publishing via Trusted Publishing (release.yml) on version
    tags, documented in RELEASING.md.
  • Community health files, CI (Python 3.9/3.11/3.13 + CLI smoke test + package
    build).

PyPI: https://pypi.org/project/php2shell-check/

Loading