PHP2Shell is a critical flaw in PHP itself, fixed on 21 October 2026. If you run WordPress, Drupal, Laravel, Nextcloud or anything else on PHP, the first step is knowing which version serves your site. We made two free tools that find out and walk you through the fix. Nothing you run is sent to us.
two free tools · nothing leaves your machine
PHP2SHELL.md is a brief for Cursor, Claude, ChatGPT or Copilot. Your agent searches your repos for every PHP runtime — Dockerfiles, CI, hosting config, bundled apps like WordPress — checks each against the fixed releases and writes you a short, ordered fix list. It never sends exploit traffic and changes nothing without your yes.
curl -fsSLO https://inject.md/php2shell-check.sh less php2shell-check.sh sh php2shell-check.sh
Read-only. Finds the PHP binaries on the machine, reads their versions, asks the package manager who installed them and lists PHP containers. Prints a plain verdict for each.
fixed releases
| Branch | Vulnerable | Fixed in |
|---|---|---|
| 8.5 | < 8.5.12 | 8.5.12 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.2 | < 8.2.35 | 8.2.35 |
PHP 8.1 and older are past upstream support. The PHP team published minimal source backports for 7.4, 8.0 and 8.1, and your vendor may ship its own. Otherwise, migrate. If your PHP came from Debian, Ubuntu or RHEL packages, the version number may not show a backported fix — check your distribution’s security tracker.
what to do
Full guidance: php2shell.com, php.net security archive, CERT-EU advisory. Stuck? Write to hi@inject.md.
partner with us
Tell us what you run. Our engineers map every PHP runtime with your team, plan the upgrade around your release schedule, and go through your logs for signs of exploitation.
our audit · OWASP LLM01
Prompt injection is the top-ranked risk to LLM applications, and it does not arrive through your chat box. It hides in a web page, an email, a PDF, a tool response — anything your model is asked to read. Then it acts with your model’s permissions.
live demonstration
Below is a real payload from the battery, running against a sandboxed toy model that is holding a throwaway secret. Watch the unprotected one hand it over. Then flip the toggle and watch the structural fix hold — same input, no change to the wording.
IND-001 A summariser is pointed at an article. The instruction is in an HTML comment.
1 — what the model is asked to read
The highlighted text is invisible to the human reader. The model sees it as instruction.
2 — what came back
your turn — try to make it leak
The model below is holding a throwaway secret. Write anything you like and try to get it out. It is a sandboxed toy — no real keys, no real model, nothing to break.
the honest part
The market is full of “jailbreak-proof prompts” and master instructions sold as protection. We are not selling you one, because they do not work — and anyone telling you otherwise is selling theatre.
Injection does not live in your prompt. It lives in the data your model is told to trust. A model cannot reliably separate “instruction from my operator” from “instruction inside the document I was asked to summarise”, because both arrive as text in the same context.
What actually holds is structural. The model that reads untrusted content gets no tools and no secrets; a separate step decides what to do. Rendered output is constrained so a leak has nowhere to go. Consequential actions sit behind a gate the model cannot talk its way past.
what we measured
| Reference target | Resistance | Failed |
|---|---|---|
| No defences | 2/100 | 42 |
| Quarantine architecture | 100/100 | 0 |
Identical 46-payload battery against both, including 13 critical findings on the undefended one. The delta is architecture — not prompt wording, and not a filter.
Reference targets are our own undefended and quarantined test apps, not a customer system. A score here is not a claim about yours.
what you actually get
46 payloads across 5 classes — direct override, obfuscation and encoding, indirect injection through content you ingest, exfiltration side-channels, and agentic tool abuse. Each one cites the technique it implements.
A resistance score, per-class breakdown, and every payload’s verdict — as self-contained HTML you can forward to a CISO, plus JSON for your pipeline. Anything a string match cannot settle is marked needs review rather than quietly passed.
See a full sample report → (our own undefended reference target)
The structural layers, in the order worth doing them, mapped to the classes you actually failed. Reference prompts appear as one layer among several — never as the whole answer.
it runs where you run it
# your keys never touch our servers
pip install -r requirements.txt
python3 scanner/scanner.py \
--endpoint https://your-app.com/api/chat \
--response-field choices.0.message.content \
--header "Authorization: Bearer $KEY" --html report.htmlNon-zero exit on any failure, so it drops straight into CI as a gate.
pricing
The free scan is genuinely useful and needs no card. The paid tiers exist because the corpus keeps moving — new attack classes land, and resistance rots between releases.
See whether the obvious attacks already work on you.
The full battery, scored, with the fixes that actually hold.
Injection resistance rots. Catch the regression, not the incident.
Audit your clients and put your own name on the report.