The phpshield command line.

PHPShield needs Python 3.8 or newer and nothing else: no pip packages, no compiler, no network for installation. Pick whichever path fits the box you are triaging.

Zero install (recommended for incident response)

Download the single-file application and run it with the Python already on the host. The .pyz is a standard zipapp that bundles the whole package and its vulnerability database.

curl -LO https://phpshield.live/downloads/phpshield.pyz
python3 phpshield.pyz scan

Every subcommand works the same way: python3 phpshield.pyz version 8.3.12, python3 phpshield.pyz fix, and so on. Throughout these docs the command is written as phpshield; substitute python3 phpshield.pyz if you are running the bundle.

One-liner triage with quickcheck.sh

For a 3am first look, quickcheck.sh is POSIX shell with no dependencies. It only reads php -v for every PHP binary on PATH and tells you whether each is affected by PHP2Shell. It does not inspect configuration, dependencies, code or running workers; use the full scan for that.

curl -LsS https://phpshield.live/downloads/quickcheck.sh | sh

When it finds an affected binary it exits 1; an end-of-life branch exits 1 with a migration note; no PHP on PATH exits 0 with a reminder that a web server may still bundle its own PHP via FPM or mod_php.

A real command on PATH

phpshield.pyz starts with a #!/usr/bin/env python3 line, so it runs as a command once it is executable. Copy it onto PATH under the name phpshield:

sudo install -m 755 phpshield.pyz /usr/local/bin/phpshield
phpshield --version

1. Check a single version

phpshield version takes any version string (8.3.12, the first line of php -v, or an X-Powered-By header value) and prints a verdict:

$ phpshield version 8.3.12

  PHP 8.3.12   CRITICAL

  PHP 8.3.12 is affected by a critical, actively exploited
  vulnerability. Upgrade to 8.3.36 now.

  Advisories:
    CVE-2026-109618  PHP2Shell  critical [fixed in 8.3.36] [exploited in the wild]
    CVE-2026-109619  PHP2Shell  critical [fixed in 8.3.36] [exploited in the wild]

  Missing security releases on branch 8.3: 8.3.14, 8.3.19, 8.3.23, ... 8.3.36

  Upgrade to: 8.3.36
  Branches in active support: 8.5 -> 8.5.12   8.4 -> 8.4.27

  data: php.net · generated 2026-10-22T19:46:34.867Z

2. Scan a webroot

Point scan at a path (it defaults to the current directory). With no flags it also inspects the host's PHP binaries, /etc configuration and running workers; add --no-system to scan only the files you name. Output is grouped by category and coloured on a TTY.

phpshield 1.0.0  (data: php.net, generated 2026-10-22T19:46:34.867Z)
scanned: ./example.com
findings: 2 critical, 2 high, 1 low, 1 info

== Indicators of compromise (2) ==
[CRITICAL] COMPROMISE-EXEC-SUPERGLOBAL  Command or code executed directly from request input
    example.com/public/up.php:1
    evidence: <?php @eval($_POST["x"]);
    fix: Treat this host as compromised. Isolate it, preserve the file ...

== File integrity (2) ==
[CRITICAL] INT-ENV-EXPOSED  Environment file served from a public web root
    example.com/public/.env
...
RESULT: findings at or above high. (exit 1)

The header line gives the counts by severity; each finding carries a stable rule id, a location, masked evidence, a concrete fix and sources. The final RESULT line and the exit code reflect --fail-on (default high): 0 = nothing at or above the threshold, 1 = findings at or above it, 2 = a usage or runtime error.

3. Get the fix steps

phpshield fix detects this host's platform, PHP branch and SAPI and prints the exact upgrade, restart and verify commands, the interim mitigations and the after-patch checklist. The output never runs anything; --format sh -o fix.sh writes a script for you to review and run yourself.

phpshield fix                       # detect this host and print the playbook
phpshield fix --platform ubuntu-ondrej --branch 8.3 --sapi fpm-fcgi
phpshield fix --format sh -o fix.sh  # a reviewable script; NOT executed

phpshield scan [PATH ...]            # PATH defaults to the current directory

Flags

Exit codes

--fail-on is what makes scan useful as a gate. --fail-on never always exits 0, which is handy when you want the report but not a failing step.

Only the scheme and host of --rpc and --webhook are ever printed or saved, because provider RPC URLs usually carry an API key and a Slack or Discord webhook URL is itself a secret.

Token delegations: phpshield delegates

A delegate can move up to its approved amount out of a token account without the owner signing. Card and DeFi apps set them on purpose; a delegate you do not recognise is a standing spend permission someone else holds. The command validates ADDRESS, then calls getTokenAccountsByOwner with jsonParsed encoding once for the spl-token program and once for Token-2022, and lists the accounts whose parsed data has a delegate.

Token delegations for OWNER_WALLET
  endpoint: https://api.mainnet-beta.solana.com (spl-token and Token-2022 accounts)
  1 token account(s) with an active delegate:

    mint              EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v  (spl-token)
    delegate          DELEGATE_1
    delegated amount  4  (balance 0.983234)
    token account     TOKEN_ACCOUNT_1
    revoke            spl-token revoke TOKEN_ACCOUNT_1

Revoking is your action, in your wallet. spl-token revoke <TOKEN_ACCOUNT_ADDRESS> clears the delegate on one token account, signed by your default keypair (pass --owner KEYPAIR otherwise). Most wallets also have a revoke or token-approvals screen. If the owner key itself may have leaked, revoking is not enough: move the tokens to a freshly generated wallet.

Watching a wallet: phpshield wallet --watch

--watch turns phpshield wallet into a watcher. The first cycle only records the newest signature as the baseline and alerts on nothing. Every later cycle asks for signatures newer than the baseline, reads each one with getTransaction, and prints them newest first with whether the wallet signed, its SOL balance change and the status. A transaction the wallet signed is the alert that matters: it needs the private key, so one you did not make means someone else has the key.

Exit codes: Ctrl-C stops a running watch with 0. With --once it exits 1 when the cycle found a new transaction signed by the wallet, 0 otherwise, and 2 on a bad flag or when the signature lookup fails (the baseline is left as it was).

# every 5 minutes: alert Slack when the hot wallet has new activity
*/5 * * * * /usr/bin/python3 /opt/phpshield.pyz wallet HOT_WALLET_ADDRESS --watch --once \
  --webhook "$SLACK_WEBHOOK_URL" --webhook-format slack

The Crypto & Solana page has the same two checks in the browser. Its watcher polls every 60 seconds while the tab is open and can raise a browser notification. Browsers get a narrower choice of public endpoints: api.mainnet-beta.solana.com refuses every request that carries a browser Origin header, and PublicNode (the page's default) answers activity lookups but refuses getTokenAccountsByOwner and keeps only a few days of history, so the delegation check there needs your own RPC URL. The CLI has neither limit.

JSON envelope

Every JSON report has the same top-level shape. summary, findings, errors and installs are always present.

{
  "tool": "phpshield", "version": "1.0.0",
  "generated_at": "2026-10-22T06:21:46Z", "data_generated_at": "2026-10-22T19:46:34.867Z",
  "target": ["./example.com"],
  "summary": {"total": 7, "by_severity": {"info": 1, "low": 2, "medium": 0, "high": 2, "critical": 2},
              "by_category": {"compromise": 3, "integrity": 2, "code": 1, "dependency": 1},
              "worst": "critical", "fail_on": "high"},
  "findings": [{"id": "COMPROMISE-EXEC-SUPERGLOBAL", "severity": "critical", "category": "compromise",
                "title": "Command or code executed directly from request input",
                "location": "example.com/public/up.php", "line": 1,
                "evidence": "<?php @eval($_POST[\"x\"]);", "fix": "Treat this host as compromised ...",
                "references": ["https://www.php.net/manual/en/function.exec.php"],
                "confidence": "high", "fingerprint": "ca22005545e240ac"}],
  "errors": [], "installs": []
}

fingerprint is stable across runs for the same finding, which is how monitor tells NEW from RESOLVED and how SARIF results dedupe in code scanning.

name: PHPShield
on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "0 7 * * 1"   # weekly re-scan catches newly disclosed CVEs

permissions:
  contents: read
  security-events: write  # required to upload SARIF

jobs:
  phpshield:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Scan
        id: scan
        run: |
          curl -LsSO https://phpshield.live/downloads/phpshield.pyz
          set +e
          python3 phpshield.pyz scan . --format sarif -o phpshield.sarif --fail-on high
          echo "code=$?" >> "$GITHUB_OUTPUT"
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: phpshield.sarif
          category: phpshield
      - name: Fail on findings at or above high
        if: steps.scan.outputs.code != '0'
        run: exit ${{ steps.scan.outputs.code }}

The SARIF is uploaded before the job fails, so results reach the Security tab even on a failing run. --fail-on takes info, low, medium, high, critical or never; add --offline to skip the Packagist and WordPress checks.

Other CI

python3 phpshield.pyz scan . --format sarif -o phpshield.sarif --fail-on high

Exit 1 fails the step when something is at or above --fail-on; exit 2 means the scan itself could not run.

It accepts every scan flag, plus:

[2026-10-22 02:22:01] phpshield monitor: 7 finding(s): 7 new, 0 resolved
  NEW:
    * [CRITICAL] COMPROMISE-EXEC-SUPERGLOBAL: Command or code executed directly from request input (example.com/public/up.php:1)
    * [CRITICAL] INT-ENV-EXPOSED: Environment file served from a public web root (example.com/public/.env)
    ...
second run, nothing changed:
[2026-10-22 02:22:01] phpshield monitor: 7 finding(s): 0 new, 0 resolved
  no change since last run

Under cron

# every 6 hours: scan /var/www, notify Slack on any change
0 */6 * * * /usr/bin/python3 /opt/phpshield.pyz monitor /var/www --once \
  --webhook "$SLACK_WEBHOOK_URL" --webhook-format slack --fail-on never

Use --fail-on never under cron if you do not want a non-zero exit to be logged as a job failure; drop it if you do.

The only outbound requests are read-only lookups of public vulnerability data, and they happen only for the commands that need them. All network I/O goes through one small module (cli/phpshield/net.py) so it is easy to audit. --offline disables every one of them.

That is the whole list. PHPShield contacts no telemetry, analytics or update server of its own. Run with --offline and it uses only the data bundled in the tool; no connection leaves the host. You can read every module in the source browser.

PHPShield is defensive tooling: it helps you find and fix exposure on systems you operate. It is not a scanner for other people's hosts, it ships no exploit code, and it is independent and not affiliated with the PHP Group.