Exploit for Improperly Controlled Sequential Memory Allocation in Php

**Find and fix PHP security exposure, starting with PHP2Shell.** Shellproof is an

open-source, defensive toolkit for PHP administrators: a command-line scanner

and a static website that both read one vulnerability data layer sourced from

[php.net]( It runs on the machine you operate and the

paths you give it. Nothing the scanned host is ever uploaded.

- **CLI** (`shellproof`) — Python 3.8+, standard library only, no dependencies.

- **Website** (`site/`) — static HTML/CSS/vanilla ES modules, no build step and

no third-party requests beyond the read-only APIs listed under

Shellproof is independent and **not affiliated with the PHP Group**. MIT licensed.

## Why: PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

PHP2Shell is a pair of **critical, unauthenticated remote-code-execution**

vulnerabilities in the PHP engine, **exploited in the wild** before a fix

shipped. They were fixed on **2026-10-21** in **PHP 8.5.12, 8.4.27, 8.3.36 and

8.2.35**. PHP 8.1 and older are end-of-life and receive no official fix.

Patching the binary is necessary but not sufficient: PHP workers (FPM pools,

mod_php, LiteSpeed lsphp, FrankenPHP, php-cgi, queue workers) that started

before the upgrade keep running the old code until restarted, and any host that

was internet-facing beforehand should be treated as potentially compromised and

- php-src advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618) —

- php-src advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) —

The in-depth writeup lives at [`site/advisories/php2shell/`](site/advisories/php2shell/).

# Zero install: one file + any Python 3.8+

curl -LO

python3 shellproof.pyz scan # scan the current directory + this host

pipx install git+

shellproof version 8.3.12 # verdict for one version string

shellproof scan /var/www --format sarif -o shellproof.sarif

shellproof fix # detect this host, print upgrade steps

`shellproof scan` exits `0` when nothing is at or above `--fail-on` (default

`high`), `1` when something is, and `2` on a usage or runtime error.

Full command reference, report formats, CI and the privacy model are documented

at [`site/docs/`](site/docs/) (the `/docs` page on the website).

| `scan [PATH ...]` | Full scan: PHP runtime, php.ini/FPM/web-server config, `composer.lock` dependencies, risky code and webshells, exposed crypto keys, and WordPress/`.env`/backup integrity. Reports in `text`, `json`, `sarif`, `html` or `md`. |

| `version VERSION` | Verdict for one PHP version string (accepts `php -v` output, `X-Powered-By`, etc.). `--json` for the full structure. |

| `fix` | Detect this host's platform/branch/SAPI and print the upgrade, restart and verify commands, interim mitigations and the after-patch checklist. `--format sh` writes a reviewable script that is **not** executed. |

| `monitor` | Re-scan on an interval, diff by fingerprint, report NEW/RESOLVED, check php.net for new releases, optionally POST to a webhook. `--once` for cron. |

| `wallet ADDRESS` | Read-only Solana activity for one address (checking whether an exposed hot wallet moved funds). |

| `update` | Refresh the vulnerability data from php.net into `~/.cache/shellproof`. |

See `shellproof --help` for exact flags, or the

A **GitHub Action** (`action.yml`) wraps `scan`, uploads SARIF to GitHub code

scanning and fails the job on findings at or above a threshold. A POSIX

**`quickcheck.sh`** does a dependency-free first look at the PHP binaries on

`site/` is a static site with no build step. It mirrors the CLI's checks as

in-browser checkers (files are read locally with the File API — nothing is

uploaded), plus fix playbooks, the PHP2Shell advisory, a guide for Solana and

crypto operators, these CLI docs, and a source browser.

- `/` and `/advisories` — overview and the advisory index

- `/advisories/php2shell/` — the PHP2Shell writeup

- `/check/` — run the checkers in your browser

- `/fixes/` — interactive per-platform upgrade generator

- `/crypto/` — Solana and crypto operator guide

All vulnerability data comes from **php.net** and is kept in `shellproof/data/`:

| `php-releases.json` | Every PHP release, dates, security flags, CVEs | `scripts/build_data.py` |

| `branches.json` | Per-branch support windows | `scripts/build_data.py` |

| `advisories.json` | Curated advisories and mitigations | maintained by hand, cited |

| `ini-rules.json`, `code-rules.json`, `crypto-rules.json`, `platforms.json` | Audit rules and fix playbooks | maintained in-repo |

python3 scripts/build_data.py # rebuild shellproof/data from php.net

shellproof update # refresh ~/.cache/shellproof for an installed CLI

The CLI prefers the cache in `~/.cache/shellproof` (written by `shellproof update`

or `shellproof monitor`) over the copy bundled in the tool, so it stays current

between releases. Every report records the `data_generated_at` timestamp of the

# Build the static site in place: copy data into site/data,

# stamp the shared header/footer into every page, and build the download bundle.

# Build just the single-file CLI (zipapp) into site/downloads/shellproof.pyz

`shellproof.pyz` bundles the whole `shellproof/` package including its data, so it

runs with nothing but a Python 3.8+ interpreter: `python3 shellproof.pyz scan`.

# JavaScript (Node 18+ built-in test runner)

Network-dependent tests are skipped by default. Run them once against the live

SHELLPROOF_NET_TESTS=1 python3 -m unittest discover -s tests

The Python module and its JavaScript twin rule data in `shellproof/data/`

and are checked for parity against shared cases files under

`tests/fixtures//`, so both produce the same findings for the same

- **It scans only what you operate** — the machine it runs on and the paths you

- **Secrets never leave the machine.** Any detected private key, seed phrase or

API key is masked before it reaches a finding, a report, the console or the

DOM. Nothing scanned is uploaded. The browser checkers read files locally.

- **No exploit code.** There are no proof-of-concept payloads or

step-by-step attack recipes — only the official advisories' plain-language

- **No telemetry.** The only outbound requests are the read-only vulnerability

lookups below, and an optional webhook you configure. `--offline` disables

all of them. Every request is made through one auditable module,

The complete list of endpoints Shellproof may :

| ` ` | `update`, `monitor`, `build_data.py` | PHP release index and changelogs |

| `packagist.org/api/security-advisories/` | `scan` (deps), `monitor` | advisories for `composer.lock` package names (names only) |

| `api.wordpress.org/core/checksums/1.0/` | `scan` (integrity), `monitor` | official core checksums for a detected WordPress version |

| Solana JSON-RPC (default `api.mainnet-beta.solana.com`, `--rpc` to override) | `wallet`, `scan` (crypto) | read-only `getSignaturesForAddress` for an address you supply |

| your `--webhook` URL | `monitor` | the finding delta, only if you configure it |

MIT — see [`LICENSE`](LICENSE). Copyright (c) 2026 Shellproof contributors.

Shellproof is independent and not affiliated with the PHP Group. "PHP" is a

trademark of the PHP Group; references here are descriptive.