Skip to content

PHP2Shell Checker 0.2.0

Choose a tag to compare

View all tags
@toxy4ny toxy4ny released this 23 Oct 16:39
· 3 commits to main since this release
v0.2.0
0f7fc0a

PHP2Shell Checker 0.2.0 adds separate CVE results, Linux process inspection and structured JSON reports for Debian 12 and 13.

  • Installed and candidate package findings for CVE-2026-109618 and CVE-2026-109619, with references and counts.
  • Deleted/replaced PHP executable and PHP module detection through procfs, with PID, service hints, evidence and coverage gaps.
  • --format json (schema 1.0), structured operational errors and --version.
  • The 23 October PHP notice for CVE-2026-115560, reported as REVIEW, with conditions and mitigation guidance.
  • Updated README, report contract and changelog. No package installation, service restarts, PHP execution or network requests by the checker.

Exit-code change: completed scans currently return 2 because the supplemental advisory requires manual configuration/application review. Use summary.package_exit_code and summary.process_exit_code for independent component results while retaining review_required. A fixed package or absence of stale files is not a whole-host safety verdict.

sudo python3 check-php2shell.py
sudo python3 check-php2shell.py --format json > report.json

Validation: 22 automated tests passed in both Debian 12 and Debian 13 containers, including real dpkg version comparisons and a real deleted-executable procfs test. Text/JSON smoke checks also passed with PHP installed and a running PHP process detected.

References: PHP advisory, CVE-2026-109618, CVE-2026-109619.

Assets 4
Loading