whichphp v0.1.0

The first release of whichphp: find every PHP build inside a container image, without running it, and get a verdict with evidence for the PHP2Shell CVEs (CVE-2026-109618 and CVE-2026-109619).

What's in it

• whichphp image finds the PHP CLI, PHP-FPM, Apache's mod_php, CGI and embedded builds in an image, and gives one verdict per CVE. It reads distro backports (Debian, Ubuntu, Alpine, RHEL and others), recognizes end-of-life branches and third-party builds (Sury, Remi), and reports the effective session.upload_progress.enabled, the only mitigation for the still-unfixed CVE-2026-115560.
• Output as a table, JSON, SARIF for GitHub code scanning, or OpenVEX. Repeat -o to write several in one run.
• A GitHub Action that checks an image in CI, writes the result to the job summary, fails the step when action is needed, and can upload to code scanning.
• A daily public index of popular PHP images on amd64 and arm64: https://yusufyildiz34.github.io/whichphp/

Verify your download

Every archive has a SHA-256 in SHA256SUMS and signed build provenance from this repository's release workflow:

sha256sum --ignore-missing -c SHA256SUMS        # on macOS: shasum -a 256 --ignore-missing -c SHA256SUMS
gh attestation verify whichphp_0.1.0_linux_amd64.tar.gz --repo yusufyildiz34/whichphp

whichphp_0.1.0.sigstore.json is the same provenance as a bundle. Pass it with --bundle to check a download without GitHub's attestation API.

Known limits

A verdict covers the image as published, not settings changed at runtime, and says nothing about whether a system was compromised before it was fixed. See what a verdict does not prove.