Skip to content

PHP2Shell Checker 0.3.0 — Brotli assessment

Latest
Latest

Choose a tag to compare

View all tags
@toxy4ny toxy4ny released this 23 Oct 17:29
v0.3.0
22546ea

PHP2Shell Checker 0.3.0 adds a separate Debian 12/13 Brotli package audit for CVE-2026-111497 (Node2Shell).

  • Inventory Brotli source-package records, including the runtime library, CLI, Python binding and development package; assess installed versions and APT candidates separately.
  • Report exact known affected Debian versions without inventing a fixed Debian revision. Unverified backports and unmapped builds remain UNKNOWN. Only eligible newer FIXED candidates are suggested for upgrades; package holds are respected.
  • JSON schema 1.1 adds brotli, cves["CVE-2026-111497"], summary.brotli_exit_code and summary.brotli_updates_required. Existing PHP package records/counts remain separate. Combined update findings and commands include PHP and Brotli.
  • Update SKILL.md, README and the report contract to distinguish library metadata from application reachability, and explain how to interpret older reports without Brotli results.

Scope: package presence does not prove an exploitable PHP/cURL or Node.js application. Reachability and loaded Brotli libraries are not checked; custom/static/vendored copies are not inventoried. NOT_INSTALLED means no matching dpkg package, not absence of Brotli everywhere. The existing process scan remains PHP-only.

Rule snapshot: on 2026-10-23, Debian lists source versions 1.0.9-2 (Debian 12) and 1.1.0-2 (Debian 13) as affected, with no fixed Debian package version recorded. The embedded upstream thresholds are 1.0.10, 1.1.1 and 1.2.1 within their respective branches. See the Debian tracker for current status.

Completed scans still return exit code 2 because the separate PHP CVE-2026-115560 notice requires manual review. Use the documented component codes without dropping unresolved findings.

sudo python3 check-php2shell.py
sudo python3 check-php2shell.py --format json > report.json

Validation: all 33 automated tests and installed PHP/Brotli text/JSON smoke checks passed in both Debian 12 and Debian 13 containers. SKILL.md validation passed. GitHub Actions is the CI source; GitLab remains a mirror with pipelines disabled.

Assets 4
Loading