PHP2Shell Shield v1.4.0

Stronger, advisory-complete mitigations (closing the gaps from an honest review against the published PHP2Shell advisories).

New

• fatal_error_backtraces=0 on PHP 8.5 — the advisory's 8.5-specific hardening (Sophos).
• post_max_size=32M — caps request size to shrink the out-of-memory attack surface. Applied only when your current limit is higher (never raised), and reversible with the shield.
• Host-level hardened snippet — the Manual snippet now also offers the php_admin_value / PHP-FPM-pool / Apache form that applications cannot override at runtime, alongside the auto form, with a plain note on the difference. (A plugin cannot write that form itself, so it is offered for your host.)

Under the hood

• Pack updated to 1.1.0 (re-signed); the map is resolved for your PHP branch and current post_max_size, then snapshotted so the displayed and re-applied settings stay consistent.

No change to the two headline settings (memory_limit=-1, session.upload_progress.enabled=0). Still a shield, not a cure — update PHP to a fixed version when you can.

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.3.5

Readme / description polish (text only, no code change).

• Fixed nine em-dashes that an earlier ASCII normalization had turned into stray double-quotes — in the short description, the external-services notes, and older changelog entries. The description now reads cleanly.

No behaviour change from v1.3.4.

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.3.4

Breach-check false-positive fix (no other behaviour change).

• The uploads scan previously reported any .php under wp-content/uploads as a hidden shell — including the standard // Silence is golden. index.php that WordPress core, many plugins, and this plugin's own uploads/php2shell-shield/backups/ folder legitimately create.
• The scan now skips an index.php only when it is empty or comment-only (no executable PHP). Anything containing real PHP is still reported — verified against a live shell, a comment-then-eval() decoy, and an oversized "comment" file, which are all still flagged.

If your previous scan listed php2shell-shield/backups/index.php (or a similar silence file) as a breach, that was this false positive — not a real compromise.

Update arrives automatically on 1.1.1+ (signed + verified).

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.3.3

Wider WordPress compatibility (no behaviour change).

• Installs on WordPress 3.6 → current. Lowered Requires at least from 4.0 to 3.6 — the true code floor (the oldest WordPress API the plugin uses is wp_unslash). This is deliberate: the oldest sites are the ones most likely to still run vulnerable PHP, and they can now install the shield, while current WordPress stays fully supported.
• No feature uses an API newer than WordPress 3.6, so old and new sites are both covered.
• Requires PHP stays 5.4 (the oldest affected PHP) and Tested up to is the current WordPress release.

A dedicated WordPress.org build (no self-updater) is produced by ./build.sh dotorg for directory submission; this GitHub build keeps its signed self-updater.

Update arrives automatically on 1.1.1+ (signed + verified).

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.3.2

WordPress.org compliance / code-quality pass (no behaviour change).

• Passed the WordPress Plugin Check: direct-access guards on every file, sanitised $_SERVER reads, cURL → HTTP API, mt_rand → wp_rand, json_encode → wp_json_encode, documented the deliberate direct filesystem operations, and confirmed a nonce on every action.
• A dedicated WordPress.org build (no self-updater) is produced by ./build.sh dotorg for directory submission; this GitHub build keeps its signed self-updater.

Update arrives automatically on 1.1.1+ (signed + verified).

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.3.1

Bug fix for the breach check.

• Fixed: the breach check was listing the bundled default add-ons (Hello Dolly, Akismet) under "Core files differ from WordPress.org". WordPress.org's core checksums include those files, but they legitimately change — you might delete Hello Dolly, and Akismet updates on its own — so they were false positives.
• The core integrity check now verifies real core files only (wp-admin/, wp-includes/, root files). Akismet and other plugins are still verified accurately by the separate plugin check.

Update arrives automatically on 1.1.1+ (signed + verified).

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.3.0

The real fix for PHP2Shell is updating PHP — so this release makes that safe and easy.

New: Upgrade PHP tools

• Compatibility check — scans your active plugins and theme for code that newer PHP removed (which would cause fatal errors), and tells you plainly whether you're ready to move up, with the exact files/lines if not. The lowest PHP with an official PHP2Shell fix is 8.2.
• One-click PHP switch (cPanel EA4) — where your site selects PHP in .htaccess, the plugin can switch it for you: it backs up .htaccess, switches, confirms your site comes up on the new version, and automatically rolls back if it doesn't. Other hosts get guided cPanel MultiPHP Manager steps.

Honest limits

• The compatibility check is a strong readiness indicator, not a guarantee — a quick staging test is the only certainty.
• Switching PHP is a hosting-panel action; the one-click switch works where the version lives in .htaccess (common on cPanel EA4). Elsewhere, use MultiPHP Manager.

Update

On 1.1.1+ this arrives automatically (signed + verified). Otherwise download below and upload once.

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.2.0

A brand-new look for the dashboard — modern, light, and reassuring.

What's new

• "Command deck" dashboard — an animated shield core showing your live status, a protection-layers meter (how many defences are active), and a visual defense pipeline that shows an attack being stopped before it reaches PHP.
• Light & friendly — premium and clear rather than alarming, so non-technical site owners aren't scared off.
• Honest by design — it shows only real data about your site (no fake "requests blocked" counters), and still never claims more safety than it delivers.

Unchanged

• Every protection, the signed auto-updater, PHP 5.4+ / WordPress 4.0+ support, and 111 passing tests.
• Still a shield, not a cure — update PHP to a fixed version when you can.

Update

If you're on 1.1.1+, this arrives automatically on your Plugins screen (signed + verified). Otherwise download php2shell-shield-v1.2.0.zip below and upload it once.

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.1.1

Updates can now install themselves from GitHub — safely.

What's new

• GitHub auto-updater — new versions show up on your Plugins screen and install in one click, straight from this project's GitHub Releases. No manual re-upload.
• Signed updates — because this is a security plugin, every update is cryptographically verified (RSA-SHA256) against the plugin's bundled signing key before WordPress installs it. An unsigned or tampered download is refused, not installed.

Notes

• Each release ships two files: the plugin zip and a matching .sig signature. The updater checks the signature; you never have to.
• Update checks are cached (~12h) and the only external calls are to api.github.com / github.com (disclosed in the readme).
• Still a shield, not a cure — update PHP to a fixed version when you can.

Install / update

From 1.1.0 or earlier: update once manually (download php2shell-shield-v1.1.1.zip below → Plugins → Add New → Upload). After that, future updates arrive automatically on your Plugins screen.

---

Built by AbodyStudio · support@abodystudio.com

PHP2Shell Shield v1.1.0

A visual refresh of the admin dashboard, plus broader compatibility. Protection still works the same — this release is about how it looks and reads.

What's new

• Redesigned dashboard — a modern, visual layout: brand hero with the shield logo, a plain-language "How it works" strip, icons on every panel, and clearer grouping (Protection · More protection · Check & recover · Details).
• Fixed the manual snippet boxes — the code is now always clearly visible (dark background, bright text).
• Shield menu icon — the WordPress admin menu now shows the PHP2Shell Shield shield.
• Broader compatibility — now runs on WordPress 4.0+ (still PHP 5.4+).
• Plain-English README — added an "In plain English (no jargon)" section for non-technical readers.

Still true

• A shield, not a cure: the only real fix for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is updating PHP to a fixed version. This plugin reduces risk and tells you if you were already hit.
• 103 automated tests pass; verified PHP 5.4+ compatible.

Install / update

Download php2shell-shield-v1.1.0.zip below → WordPress → Plugins → Add New → Upload. Updating from 1.0.0 keeps all your settings.

---

Built by AbodyStudio · support@abodystudio.com · abodystudio@gmail.com