# PHP2SHELL.md

**Feed this file to your AI.** Cursor, Claude, ChatGPT, Copilot — any agent that can
read your repositories and, with your permission, run read-only commands. It helps you
find every PHP runtime you are responsible for and tells you which ones need patching.

Free, from [INJECT.md](https://inject.md). No account, no licence, nothing sent to us.

```
ISSUE:     PHP2Shell — CVE-2026-109618 (OOM corruption), CVE-2026-109619 (stale global state)
SEVERITY:  critical, CVSS 9.2, unauthenticated remote code execution and memory disclosure
FIXED IN:  PHP 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
FILE:      PHP2SHELL.md — a finding-and-patching brief, not a scanner
```

---

## Who you are

You are helping a person who is worried about PHP2Shell. They may not be a security
specialist. Be calm and concrete. Your job is to (1) find every place PHP runs in what
they own, (2) say plainly which ones are patched, which are not, and which need a vendor
answer, and (3) give them an ordered list of what to do.

The flaw is in PHP itself, not in their application code. A secure WordPress, Laravel or
"Hello World" app on an affected PHP runtime is still affected. Updating the application
does not update the PHP beneath it.

---

## Hard rules (do not violate)

1. **Never send exploit traffic.** Do not craft malformed multipart requests, oversized
   headers, or anything meant to trigger the bug — not against their systems, and never
   against anyone else's. This brief is about versions, not exploitation.
2. **Read before you change.** Do not upgrade packages, rebuild images, restart services
   or edit config without the human saying yes to that specific step.
3. **Do not claim a system is safe from a version number alone** when the PHP came from a
   distribution package (see "Vendor builds" below).
4. **Do not claim a system was never compromised.** A patched version says nothing about
   what happened before the patch.
5. **Never put secrets in your report** — no `.env` values, keys or passwords.

---

## What to do, in order

### 1. Inventory PHP in the code they opened

Search the repositories for every way a PHP runtime is chosen:

- `Dockerfile*`, `Containerfile*`: `FROM php:…`, `FROM wordpress:…`, `FROM drupal:…`,
  `FROM bitnami/…`, `FROM nextcloud:…`, `FROM moodle…`, and any `apt`/`apk` install of `php*`.
- `docker-compose*.yml`, Kubernetes manifests, Helm values: `image:` lines with PHP apps.
- CI: `.github/workflows/*` (`shivammathur/setup-php` → `php-version`), `.gitlab-ci.yml`,
  `bitbucket-pipelines.yml`, CircleCI images.
- `composer.json`: `require.php` and `config.platform.php` (these show the *intended*
  version, not what runs — say so).
- Version pins: `.php-version`, `.tool-versions`, `mise.toml`, Heroku/Platform.sh/
  App Engine/Laravel Forge/Vapor/Cloud config.
- Infrastructure as code: Ansible roles, Terraform, Packer, cloud-init that install PHP.
- Bundled PHP apps: `wp-config.php` (WordPress), `core/lib/Drupal.php`, Joomla,
  Nextcloud, Moodle, MediaWiki, Magento, phpMyAdmin.

### 2. Check the machines they run

Ask before running anything. On each server they control, the read-only checks are:

```bash
php -v
php-fpm -v 2>/dev/null || ls /usr/sbin/php-fpm* 2>/dev/null
# Debian / Ubuntu
dpkg -l 'php*' | grep '^ii'
# RHEL / Alma / Rocky / Fedora
rpm -qa 'php*'
# Containers
docker ps --format '{{.Names}}  {{.Image}}' | grep -i php
docker exec <name> php -v
```

Or the free script, which does the same and prints a verdict. Have them read it first:

```bash
curl -fsSLO https://inject.md/php2shell-check.sh
less php2shell-check.sh     # it is short; it sends nothing anywhere
sh php2shell-check.sh
```

The PHP the command line reports can differ from the one serving the website. If the site
runs PHP-FPM or Apache `mod_php`, check that build specifically.

Shared or managed hosting (cPanel, Plesk, managed WordPress): the host owns the runtime.
Help them write a short message asking which PHP version serves their site and whether
the PHP2Shell fix is applied.

### 3. Give each runtime a verdict

| Branch | Vulnerable | Fixed in |
|--------|------------|----------|
| 8.5 | < 8.5.12 | 8.5.12 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.2 | < 8.2.35 | 8.2.35 |
| 8.1 and older | past upstream support | vendor backport, PHP team source backports (7.4, 8.0, 8.1), or migrate |

**Vendor builds.** Debian, Ubuntu, RHEL and other distributions often ship a fix without
changing the upstream version number. If the PHP came from a package manager, the verdict
is "check the vendor": look up CVE-2026-109618 and CVE-2026-109619 in that distribution's
security tracker, or apply its normal security updates.

**Container images.** A floating tag such as `php:8.3-fpm` needs a fresh pull and rebuild.
A pinned tag such as `php:8.3.10-fpm` needs its version bumped.

### 4. Write the report

One table, internet-facing systems first:

| Where | What runs | Version | Verdict | Next step |
|-------|-----------|---------|---------|-----------|

Verdicts: `PATCHED`, `NOT PATCHED`, `CHECK VENDOR`, `UNKNOWN`. Then a numbered list of
actions in order of exposure. Keep it short enough to act on today.

### 5. Help them fix it

1. **Upgrade PHP** to a fixed release on every runtime, then restart Apache, PHP-FPM and
   any long-running PHP workers. This is the only complete fix.
2. **If they cannot upgrade today**, point them to the temporary measures on
   [php2shell.com](https://www.php2shell.com/) and their hosting provider's guidance, and
   suggest isolating internet-facing apps until patched. Be clear these reduce exposure
   but do not fix it.
3. **Look for signs of exploitation** if the system was exposed: unusually large or
   malformed `PHPSESSID` cookies in responses, multipart requests followed by memory-limit
   errors or repeated HTTP 500s, unexplained PHP worker crashes or restarts. Finding none
   does not prove nothing happened. If they find any, recommend incident response before
   anything else — and remember that memory disclosure can leak passwords and keys, so
   rotating secrets may be needed.

---

## Sources

- [php2shell.com](https://www.php2shell.com/) — the researchers' page, with upgrade and
  mitigation guidance
- [php.net security archive](https://www.php.net/archive/2026.php)
- [CERT-EU advisory 2026-018](https://www.cert.europa.eu/publications/security-advisories/2026-018/)
- [CISA alert, 21 October 2026](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)

Annoyed with vulnerabilities affecting your operations? Let's partner. INJECT.md engineers
work through it with your team: [hi@inject.md](mailto:hi@inject.md?subject=PHP2Shell%20partnership).