PHP2Shell Checker 0.3.0 — Brotli assessment

PHP2Shell Checker 0.3.0 adds a separate Debian 12/13 Brotli package audit for CVE-2026-111497 (Node2Shell).

• Inventory Brotli source-package records, including the runtime library, CLI, Python binding and development package; assess installed versions and APT candidates separately.
• Report exact known affected Debian versions without inventing a fixed Debian revision. Unverified backports and unmapped builds remain UNKNOWN. Only eligible newer FIXED candidates are suggested for upgrades; package holds are respected.
• JSON schema 1.1 adds brotli, cves["CVE-2026-111497"], summary.brotli_exit_code and summary.brotli_updates_required. Existing PHP package records/counts remain separate. Combined update findings and commands include PHP and Brotli.
• Update SKILL.md, README and the report contract to distinguish library metadata from application reachability, and explain how to interpret older reports without Brotli results.

Scope: package presence does not prove an exploitable PHP/cURL or Node.js application. Reachability and loaded Brotli libraries are not checked; custom/static/vendored copies are not inventoried. NOT_INSTALLED means no matching dpkg package, not absence of Brotli everywhere. The existing process scan remains PHP-only.

Rule snapshot: on 2026-10-23, Debian lists source versions 1.0.9-2 (Debian 12) and 1.1.0-2 (Debian 13) as affected, with no fixed Debian package version recorded. The embedded upstream thresholds are 1.0.10, 1.1.1 and 1.2.1 within their respective branches. See the Debian tracker for current status.

Completed scans still return exit code 2 because the separate PHP CVE-2026-115560 notice requires manual review. Use the documented component codes without dropping unresolved findings.

sudo python3 check-php2shell.py
sudo python3 check-php2shell.py --format json > report.json

Validation: all 33 automated tests and installed PHP/Brotli text/JSON smoke checks passed in both Debian 12 and Debian 13 containers. SKILL.md validation passed. GitHub Actions is the CI source; GitLab remains a mirror with pipelines disabled.

PHP2Shell Checker 0.2.0

PHP2Shell Checker 0.2.0 adds separate CVE results, Linux process inspection and structured JSON reports for Debian 12 and 13.

• Installed and candidate package findings for CVE-2026-109618 and CVE-2026-109619, with references and counts.
• Deleted/replaced PHP executable and PHP module detection through procfs, with PID, service hints, evidence and coverage gaps.
• --format json (schema 1.0), structured operational errors and --version.
• The 23 October PHP notice for CVE-2026-115560, reported as REVIEW, with conditions and mitigation guidance.
• Updated README, report contract and changelog. No package installation, service restarts, PHP execution or network requests by the checker.

Exit-code change: completed scans currently return 2 because the supplemental advisory requires manual configuration/application review. Use summary.package_exit_code and summary.process_exit_code for independent component results while retaining review_required. A fixed package or absence of stale files is not a whole-host safety verdict.

sudo python3 check-php2shell.py
sudo python3 check-php2shell.py --format json > report.json

Validation: 22 automated tests passed in both Debian 12 and Debian 13 containers, including real dpkg version comparisons and a real deleted-executable procfs test. Text/JSON smoke checks also passed with PHP installed and a running PHP process detected.

References: PHP advisory, CVE-2026-109618, CVE-2026-109619.