#!/usr/bin/env python3 PK+iX]-a<< __main__.pyimport sys from phpshield.cli import main sys.exit(main()) PK+iX] phpshield/PK+iX]u{eephpshield/__init__.py"""PHPShield: find and fix PHP security exposure, starting with PHP2Shell.""" __version__ = "1.0.0" PK+iX]-a<<phpshield/__main__.pyimport sys from phpshield.cli import main sys.exit(main()) PK+iX]]11phpshield/cli.py"""The phpshield command line.""" import argparse import datetime import json import os import sys from . import __version__, data, fix, monitor, net, report, runtime, scan, wallet from .model import SEVERITIES, sev_index from .versions import extract_versions, render_verdict, verdict_for def _paint(no_color): return report.Paint(sys.stdout.isatty() and not no_color and not os.environ.get("NO_COLOR")) def _add_scan_flags(p): p.add_argument("paths", nargs="*", default=["."]) p.add_argument("--php", action="append", help="inspect this PHP binary (repeatable)") p.add_argument("--ini", action="append", help="audit this extra php.ini / pool file (repeatable)") p.add_argument("--no-system", action="store_true", help="files-only scan: no host binaries, /etc configs or processes") p.add_argument("--skip", action="append", choices=scan.CHECKS, help="skip a check (repeatable)") p.add_argument("--offline", action="store_true", help="no network: skip the Packagist advisory API and WordPress core checksums") p.add_argument("--since", default="2026-10-20", help="flag PHP files modified on or after YYYY-MM-DD") p.add_argument("--exclude", action="append", default=[], help="exclude paths matching GLOB (repeatable)") p.add_argument("--max-file-size", type=float, default=2, help="skip content checks on files larger than MB") p.add_argument("--format", choices=["text", "json", "sarif", "html", "md"]) p.add_argument("-o", "--output") p.add_argument("--fail-on", default="high", choices=SEVERITIES + ["never"]) p.add_argument("-q", "--quiet", action="store_true") p.add_argument("--no-color", action="store_true") p.add_argument("-v", "--verbose", action="store_true") def _scan_opts(a): try: since = datetime.date.fromisoformat(a.since) except Exception: raise SystemExit("phpshield: --since must be YYYY-MM-DD") net.OFFLINE = bool(a.offline) return {"php": a.php, "ini": a.ini, "system": not a.no_system, "skip": a.skip, "since": since, "exclude": a.exclude, "max_file_size": a.max_file_size} def _exit_code(findings, fail_on): if fail_on == "never": return 0 thr = SEVERITIES.index(fail_on) return 1 if any(sev_index(f.severity) >= thr for f in findings) else 0 def cmd_version(a): text = " ".join(a.text) if a.text else "" if not text: bins = runtime.find_php_binaries() versions = [v for v in (runtime.php_version_of(b) for b in bins) if v] if not versions: print("phpshield: no PHP version given and none found on PATH", file=sys.stderr) return 2 else: versions = extract_versions(text) if not versions: print("phpshield: no PHP version found in %r" % text, file=sys.stderr) return 2 paint = _paint(a.no_color) for v in versions: verdict = verdict_for(v, windows=a.windows or runtime.is_windows()) if a.json: print(json.dumps(verdict, indent=2)) else: print(render_verdict(verdict, paint)) if len(versions) > 1: print() return 0 def cmd_scan(a): opts = _scan_opts(a) log = (lambda s: print("phpshield: " + s, file=sys.stderr)) if a.verbose else (lambda s: None) findings, errors, installs = scan.run(a.paths, opts, log) code = _exit_code(findings, a.fail_on) env = report.envelope(findings, a.paths, errors, installs, a.fail_on) fmt = report.infer_format(a.output, a.format) text = report.render(env, fmt, _paint(a.no_color or bool(a.output)), a.quiet, code) report.write_out(text, a.output) return code def cmd_fix(a): detected = not (a.platform and a.branch and a.sapi) platform = a.platform or runtime.detect_platform() branch = a.branch or runtime.detect_branch() or "8.4" sapi = a.sapi or runtime.detect_sapi() fmt = a.format or (a.output.rsplit(".", 1)[-1] if a.output and "." in a.output else "text") if fmt not in ("text", "md", "sh"): fmt = "text" try: text = fix.render(platform, branch, sapi, fmt, detected) except ValueError as e: print("phpshield: %s" % e, file=sys.stderr) return 2 report.write_out(text, a.output) return 0 def cmd_monitor(a): opts = _scan_opts(a) log = (lambda s: print("phpshield: " + s, file=sys.stderr)) if a.verbose else (lambda s: None) try: interval = monitor.parse_duration(a.interval) except Exception: print("phpshield: bad --interval", file=sys.stderr) return 2 state = a.state or os.path.join(data.CACHE_DIR, "monitor-state.json") if not a.offline: try: cmd_update(argparse.Namespace(quiet=True)) except Exception: pass return monitor.run(a.paths, opts, interval, a.once, state, a.webhook, a.webhook_format, a.fail_on, log) def cmd_wallet(a): if not wallet.valid_address(a.address): print("phpshield: address is not valid base58 (32 bytes)", file=sys.stderr) return 2 if a.watch: try: interval = max(10, monitor.parse_duration(a.interval)) except Exception: print("phpshield: bad --interval", file=sys.stderr) return 2 return wallet.watch(a.rpc, a.address, interval, a.once, a.state, a.webhook, a.webhook_format, a.limit, a.json) since = datetime.date.fromisoformat(a.since) if a.since else None try: rows = wallet.activity(a.rpc, a.address, limit=a.limit, since=since, detail=min(a.limit, 10)) except Exception as e: print("phpshield: lookup failed: %s" % e, file=sys.stderr) return 2 if a.json: print(json.dumps({"tool": "phpshield", "address": a.address, "rpc": net.host_of(a.rpc), "transactions": rows}, indent=2)) return 0 print("Solana activity for %s" % a.address) print(" endpoint: %s" % net.host_of(a.rpc)) print(" %d transaction(s), newest first:" % len(rows)) for r in rows: print(wallet.format_row(r)) return 0 def cmd_delegates(a): if not wallet.valid_address(a.address): print("phpshield: address is not valid base58 (32 bytes)", file=sys.stderr) return 2 try: rows, count = wallet.delegations(a.rpc, a.address) except Exception as e: print("phpshield: lookup failed: %s" % e, file=sys.stderr) return 2 if a.json: print(json.dumps({"owner": a.address, "rpc": net.host_of(a.rpc), "count": len(rows), "delegations": rows}, indent=2)) return 1 if rows else 0 print("Token delegations for %s" % a.address) print(" endpoint: %s (spl-token and Token-2022 accounts)" % net.host_of(a.rpc)) if not rows: print(" no token account has an active delegate. Nothing to revoke.") return 0 print(" %d token account(s) with an active delegate:" % len(rows)) for d in rows: print("") print(" mint %s (%s)" % (d["mint"], d["program"])) print(" delegate %s" % d["delegate"]) print(" delegated amount %s (balance %s)" % (d["delegated_amount"], d["amount"])) print(" token account %s" % d["account"]) print(" revoke spl-token revoke %s" % d["account"]) print("") print(" A delegate can move up to the delegated amount out of that token account\n without the owner's signature. If you did not set it up on purpose, revoke\n it from the owner wallet: run `spl-token revoke `\n with the owner keypair, or use your wallet's revoke / token approvals\n feature. PHPShield only reads; it never builds, signs or sends a transaction.") return 1 def cmd_update(a): quiet = getattr(a, "quiet", False) releases, branches = {}, {} for major in (5, 7, 8): if not quiet: print("phpshield: fetching php.net release index for PHP %d" % major) res = net.get_json("https://www.php.net/releases/index.php?json&version=%d&max=-1" % major) for version, info in res.items(): maj, mn = version.split(".")[:2] branch = "%s.%s" % (maj, mn) sec = "security" in (info.get("tags") or []) try: date = datetime.datetime.strptime(info.get("date", ""), "%d %b %Y").date().isoformat() except Exception: date = None releases[version] = {"branch": branch, "date": date, "security": sec} b = branches.setdefault(branch, {"latest": version, "latestDate": date, "count": 0, "security": []}) b["count"] += 1 if sec: b["security"].append(version) if tuple(int(x) for x in version.split(".")) > tuple(int(x) for x in b["latest"].split(".")): b["latest"], b["latestDate"] = version, date for b in branches.values(): b["security"].sort(key=lambda v: tuple(int(x) for x in v.split("."))) out = {"schema": 1, "generatedAt": datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ"), "sources": {"releases": "https://www.php.net/releases/index.php?json"}, "branches": branches, "releases": releases} os.makedirs(data.CACHE_DIR, exist_ok=True) path = os.path.join(data.CACHE_DIR, "php-releases.json") with open(path, "w", encoding="utf-8") as fh: json.dump(out, fh, indent=1) data.releases.cache_clear() if not quiet: print("phpshield: refreshed vulnerability data from php.net") print(" wrote %s" % path) print(" generated_at: %s" % out["generatedAt"]) print(" %d releases, %d branches" % (len(releases), len(branches))) return 0 def build_parser(): ap = argparse.ArgumentParser(prog="phpshield", description="Find and fix PHP security exposure, starting with PHP2Shell. Runs locally; sends nothing about you anywhere.") ap.add_argument("--version", action="version", version="phpshield %s" % __version__) sub = ap.add_subparsers(dest="cmd", required=True) v = sub.add_parser("version", help="verdict for a PHP version string, php -v output or header") v.add_argument("text", nargs="*") v.add_argument("--windows", action="store_true", help="evaluate as a Windows host (php-cgi Best-Fit advisory applies)") v.add_argument("--json", action="store_true") v.add_argument("--no-color", action="store_true") v.set_defaults(func=cmd_version) s = sub.add_parser("scan", help="scan this host and the paths you give for PHP2Shell exposure") _add_scan_flags(s) s.set_defaults(func=cmd_scan) f = sub.add_parser("fix", help="upgrade, restart and verify commands for this host (or --platform/--branch/--sapi)") f.add_argument("--platform") f.add_argument("--branch") f.add_argument("--sapi", choices=list(data.platforms()["sapi_labels"].keys())) f.add_argument("--format", choices=["text", "md", "sh"]) f.add_argument("-o", "--output") f.set_defaults(func=cmd_fix) m = sub.add_parser("monitor", help="re-scan on an interval and report what changed") _add_scan_flags(m) m.add_argument("--interval", default="6h") m.add_argument("--once", action="store_true") m.add_argument("--state") m.add_argument("--webhook") m.add_argument("--webhook-format", default="json", choices=["json", "slack", "discord"]) m.set_defaults(func=cmd_monitor) w = sub.add_parser("wallet", help="read-only Solana activity for an address, optionally watched") w.add_argument("address") w.add_argument("--rpc", default=wallet.DEFAULT_RPC) w.add_argument("--since") w.add_argument("--limit", type=int, default=100) w.add_argument("--json", action="store_true") w.add_argument("--watch", action="store_true") w.add_argument("--interval", default="60s") w.add_argument("--once", action="store_true") w.add_argument("--state") w.add_argument("--webhook") w.add_argument("--webhook-format", default="json", choices=["json", "slack", "discord"]) w.set_defaults(func=cmd_wallet) d = sub.add_parser("delegates", help="list token accounts of an owner that still have a delegate") d.add_argument("address") d.add_argument("--rpc", default=wallet.DEFAULT_RPC) d.add_argument("--json", action="store_true") d.set_defaults(func=cmd_delegates) u = sub.add_parser("update", help="refresh the php.net release data into ~/.cache/phpshield") u.set_defaults(func=cmd_update) return ap def main(argv=None): ap = build_parser() a = ap.parse_args(argv) try: return a.func(a) except KeyboardInterrupt: return 0 except net.Offline as e: print("phpshield: %s" % e, file=sys.stderr) return 2 PK+iX]j+uuphpshield/codescan.py"""Code, webshell and integrity checks, mirroring lib/patterns.ts.""" import datetime import os import re from . import data from .model import Finding CODE_EXT = re.compile(r"\.(?:php\d?|phtml|phps|inc|module|ctp)$", re.I) NONCODE_EXT = re.compile(r"\.(?:jpe?g|png|gif|webp|svg|ico|txt|md|csv|json|xml|html?|css|js|pdf|zip|log)$", re.I) BACKUP_EXT = re.compile(r"\.(?:sql|sql\.gz|zip|tar|tar\.gz|tgz|bak|old|orig|swp)$", re.I) WEBROOT = re.compile(r"(?:^|/)(?:public|public_html|htdocs|www|wwwroot|web|dist|wp-content|html)/", re.I) UPLOADS = re.compile(r"(?:^|/)(?:uploads?|media|files|attachments|images)/", re.I) PHP_TAG = re.compile(r"<\?php|<\?=", re.I) _compiled = None def _rules(): global _compiled if _compiled is None: _compiled = [] for r in data.code_rules(): flags = re.I if "i" in r.get("flags", "") else 0 _compiled.append((r, re.compile(r["re"], flags))) return _compiled def _line_of(text, idx): return text.count("\n", 0, idx) + 1 def scan_text(path, text, rel=None): rel = rel or path out = [] base = os.path.basename(path) posix = "/" + rel.replace(os.sep, "/") is_code = bool(CODE_EXT.search(base)) lines = text.split("\n") def ev(n): return (lines[n - 1] if 0 < n <= len(lines) else "").strip()[:160] if is_code: for r, rx in _rules(): for i, m in enumerate(rx.finditer(text)): if i >= 50: break ln = _line_of(text, m.start()) out.append(Finding(r["id"], r["severity"], r["category"], r["title"], rel, ln, ev(ln), r["fix"], r["references"], r.get("confidence", "high"))) if not is_code and (NONCODE_EXT.search(base) or UPLOADS.search(posix)): m = PHP_TAG.search(text) if m: ln = _line_of(text, m.start()) out.append(Finding("INT-PHP-IN-UPLOAD", "critical", "integrity", "PHP code inside a file that should not contain code", rel, ln, ev(ln), "Remove the file, block script execution in upload directories (no PHP handler, no .htaccess overrides), and treat the host as compromised if the file was reachable.", ["https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload"])) if base in (".htaccess", ".user.ini"): m = re.search(r"^\s*(?:AddHandler|AddType|SetHandler)\s+[^\n]*php[^\n]*\.(?:jpe?g|png|gif|txt|ico|svg|html?)", text, re.I | re.M) if m: ln = _line_of(text, m.start()) out.append(Finding("INT-HTACCESS-HANDLER", "critical", "integrity", ".htaccess maps a non-PHP extension to the PHP handler", rel, ln, ev(ln), "Remove the handler line and set AllowOverride None so dropped .htaccess files are ignored.", ["https://httpd.apache.org/docs/current/mod/core.html#allowoverride"])) m = re.search(r"^\s*(?:php_value\s+)?auto_(?:prepend|append)_file\s*=?\s*\S", text, re.I | re.M) if m: ln = _line_of(text, m.start()) out.append(Finding("INT-AUTO-PREPEND", "high", "integrity", "auto_prepend_file / auto_append_file set per directory", rel, ln, ev(ln), "Injects a file into every request on the directory, a favoured persistence trick. Remove it unless you set it on purpose.", ["https://www.php.net/manual/en/ini.core.php#ini.auto-prepend-file"], "medium")) if re.match(r"^\.env(?:\.|$)", base, re.I): if WEBROOT.search(posix): out.append(Finding("INT-ENV-EXPOSED", "critical", "integrity", "Environment file served from a public web root", rel, None, None, "Move the file outside any web-served directory and make sure the web server never serves dotfiles. Rotate every secret in it.", ["https://laravel.com/docs/configuration#environment-configuration"])) m = re.search(r"^\s*APP_DEBUG\s*=\s*(?:true|1|on)\s*$", text, re.I | re.M) if m: ln = _line_of(text, m.start()) out.append(Finding("INT-APP-DEBUG", "high", "integrity", "APP_DEBUG is enabled", rel, ln, ev(ln), "Set APP_DEBUG=false in production; debug pages print environment variables and stack traces.", ["https://laravel.com/docs/configuration#debug-mode"])) if BACKUP_EXT.search(base) and WEBROOT.search(posix): out.append(Finding("INT-BACKUP-EXPOSED", "high", "integrity", "Backup or archive inside a public web root", rel, None, None, "Move backups out of the web root; a downloadable dump or archive leaks the database or source.", ["https://owasp.org/www-project-web-security-testing-guide/"], "medium")) return out def recent_modification(path, rel, since_date): base = os.path.basename(path) if not (CODE_EXT.search(base) or base == ".htaccess"): return None try: mtime = os.path.getmtime(path) except OSError: return None since = datetime.datetime.combine(since_date, datetime.time.min).timestamp() if mtime < since: return None return Finding("COMPROMISE-RECENT-MODIFICATION", "low", "compromise", "PHP file modified during the exposure window", rel, None, datetime.datetime.utcfromtimestamp(mtime).strftime("%Y-%m-%dT%H:%M:%SZ"), "Review the change against your deploys and version control; files you did not change in the window are suspect.", ["https://www.php.net/archive/2026.php"], "low") PK+iX]>mphpshield/composer.py"""composer.lock against the Packagist security-advisories API. Only package names are sent.""" import json import re import urllib.parse from . import net from .model import Finding def _norm(v): s = v.strip().lstrip("vV") if s.startswith("dev-") or s.endswith("-dev"): return None s = re.sub(r"[-+].*$", "", s) parts = [] for p in s.split("."): if p in ("*", "x"): parts.append(0) elif p.isdigit(): parts.append(int(p)) else: return None while len(parts) < 4: parts.append(0) return tuple(parts[:4]) def _bump(v, at): v = list(v) v[at] += 1 for i in range(at + 1, 4): v[i] = 0 return tuple(v) def _satisfies_and(version, group): for atom in re.split(r"\s*,\s*|\s+", group.strip()): if not atom: continue m = re.match(r"^(>=|<=|!=|<>|>|<|==|=|\^|~)?\s*(.+)$", atom) if not m: return False op, raw = m.group(1) or "=", m.group(2) stars = "*" in raw specified = len([p for p in raw.lstrip("vV").split(".") if p not in ("*", "x")]) v = _norm(raw) if v is None: return False if op == ">" and not version > v: return False if op == ">=" and not version >= v: return False if op == "<" and not version < v: return False if op == "<=" and not version <= v: return False if op in ("!=", "<>") and version == v: return False if op == "^": idx = 0 if v[0] else (1 if v[1] else 2) if not (version >= v and version < _bump(v, idx)): return False if op == "~": idx = max(0, specified - 2) if not (version >= v and version < _bump(v, idx)): return False if op in ("=", "=="): if stars: idx = max(0, specified - 1) if not (version >= v and version < _bump(v, idx)): return False elif version != v: return False return True def is_affected(version, constraint): v = _norm(version) if v is None: return False return any(_satisfies_and(v, g) for g in re.split(r"\s*\|\|?\s*", constraint)) def parse_lock(text): j = json.loads(text) out = [] for key, dev in (("packages", False), ("packages-dev", True)): for p in j.get(key) or []: if isinstance(p, dict) and "name" in p and "version" in p: out.append({"name": str(p["name"]), "version": str(p["version"]), "dev": dev}) return out def fetch_advisories(names): out = {} names = sorted(set(names)) for i in range(0, len(names), 50): qs = "&".join("packages[]=" + urllib.parse.quote(n, safe="") for n in names[i:i + 50]) res = net.get_json("https://packagist.org/api/security-advisories/?" + qs) out.update(res.get("advisories") or {}) return out def audit_lock(text, location): pkgs = parse_lock(text) findings = [] try: adv = fetch_advisories([p["name"] for p in pkgs]) except net.Offline: findings.append(Finding("DEP-OFFLINE-SKIPPED", "info", "dependency", "Dependency advisories skipped (offline)", location, None, "%d packages in lock file" % len(pkgs), "Run without --offline to look up the Packagist security-advisory database.", ["https://packagist.org/apidoc#list-security-advisories"], "high")) return findings, len(pkgs) for p in pkgs: hits = [a for a in adv.get(p["name"], []) if is_affected(p["version"], a.get("affectedVersions", ""))] if not hits: continue titles = "; ".join("%s%s" % ((a.get("cve") + ": ") if a.get("cve") else "", a.get("title", "")) for a in hits) findings.append(Finding("DEP-ADVISORY", "high", "dependency", "Dependency with a published security advisory", location, None, "%s %s%s" % (p["name"], p["version"], " (dev)" if p["dev"] else ""), "Update %s to a version outside the affected ranges (%s). Advisories: %s" % (p["name"], ", ".join(a.get("affectedVersions", "") for a in hits), titles), [a["link"] for a in hits if a.get("link")], "high", {"package": p["name"], "installed": p["version"], "advisories": hits})) return findings, len(pkgs) PK+iX]sphpshield/crypto.py"""Exposed keys and wallets, mirroring lib/secrets.ts. Secrets are masked; public addresses are derived locally.""" import re from . import data from .model import Finding, mask B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz" def b58encode(raw): n = int.from_bytes(raw, "big") out = "" while n > 0: n, r = divmod(n, 58) out = B58[r] + out pad = 0 for b in raw: if b == 0: pad += 1 else: break return "1" * pad + out def b58decode(s): n = 0 for ch in s: n = n * 58 + B58.index(ch) raw = n.to_bytes((n.bit_length() + 7) // 8, "big") if n else b"" pad = len(s) - len(s.lstrip("1")) return b"\x00" * pad + raw def address_from_secret(raw): return b58encode(raw[32:]) if len(raw) == 64 else None _compiled = None def _rules(): global _compiled if _compiled is None: _compiled = [] for r in data.crypto_rules(): flags = re.I if "i" in r.get("flags", "") else 0 _compiled.append((r, re.compile(r["re"], flags))) return _compiled def _seed_phrases(text): words = data.bip39() out, run, prev_end = [], [], None for m in re.finditer(r"[a-z]+", text, re.I): w, s, e = m.group(0).lower(), m.start(), m.end() # a phrase sits on one line; a gap over 3 chars or a line break ends the candidate run if prev_end is not None and (s - prev_end > 3 or "\n" in text[prev_end:s]): _flush(run, out) run = [] if w in words: run.append((w, s)) else: _flush(run, out) run = [] if len(run) > 24: run.pop(0) prev_end = e _flush(run, out) return out def _flush(run, out): for L in (24, 21, 18, 15, 12): if len(run) >= L: out.append(run[-L:]) return def scan_text(path, text, rel=None): rel = rel or path out = [] def line_of(i): return text.count("\n", 0, i) + 1 def push(id, sev, kind, idx, raw, fix, refs, address=None): extra = {"kind": kind} if address: extra["address"] = address out.append(Finding(id, sev, "crypto", kind, rel, line_of(idx), mask(raw), fix, refs, "high", extra)) for m in re.finditer(r"\[\s*(?:\d{1,3}\s*,\s*){63}\d{1,3}\s*\]", text): nums = [int(x) for x in re.sub(r"[\[\]\s]", "", m.group(0)).split(",")] addr = address_from_secret(bytes(n & 0xFF for n in nums)) push("CRYPTO-SOLANA-KEYPAIR-JSON", "critical", "Solana keypair (JSON byte array)", m.start(), re.sub(r"\s+", "", m.group(0)), "This is the format solana-keygen writes. Anyone who reads it controls the wallet%s. Move funds to a fresh wallet and retire this keypair." % ((" " + addr) if addr else ""), ["https://docs.solanalabs.com/cli/wallets/file-system"], addr) for m in re.finditer(r"(?= 100: break push(r["id"], r["severity"], r["title"], m.start(), m.group(1) if m.lastindex else m.group(0), r["fix"], r["references"]) for run in _seed_phrases(text): words = [w for w, _ in run] out.append(Finding("CRYPTO-BIP39-PHRASE", "critical", "crypto", "Seed phrase (%d words)" % len(words), rel, line_of(run[0][1]), "%s %s %s" % (words[0], "•••• " * min(6, len(words) - 2), words[-1]), "A BIP39 mnemonic restores every wallet derived from it. Treat the wallets as compromised, move funds, and never keep a phrase in a served file.", ["https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki"], "medium", {"kind": "Seed phrase (%d words)" % len(words)})) generic = [ ("SECRET-AWS-ACCESS-KEY", "critical", "AWS access key", r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b", "Rotate the key pair in IAM."), ("SECRET-GITHUB-TOKEN", "critical", "GitHub token", r"\bgh[pousr]_[A-Za-z0-9]{36,}\b", "Revoke the token in GitHub settings."), ("SECRET-STRIPE-LIVE", "critical", "Stripe live secret", r"\bsk_live_[A-Za-z0-9]{16,}\b", "Roll the key in the Stripe dashboard."), ("SECRET-TELEGRAM-BOT", "high", "Telegram bot token", r"\b\d{8,10}:[A-Za-z0-9_-]{35}\b", "Revoke via @BotFather."), ("SECRET-DISCORD-WEBHOOK", "high", "Discord webhook", r"https://(?:ptb\.|canary\.)?discord(?:app)?\.com/api/webhooks/\d+/[A-Za-z0-9_-]+", "Delete the webhook in the channel settings."), ("SECRET-SLACK-TOKEN", "high", "Slack token", r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b", "Revoke the token in Slack."), ] for id, sev, kind, rx, fix in generic: for m in re.finditer(rx, text): push(id, sev, kind, m.start(), m.group(0), fix, []) return out PK+iX]phpshield/data/PK+iX][#2#2phpshield/data/advisories.json{ "_source": "lib/data/advisories.ts", "advisories": [ { "id": "php2shell-oom", "name": "PHP2Shell", "cve": "CVE-2026-109618", "ghsa": "GHSA-w8hw-w9fx-j79w", "ghsaUrl": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "title": "Remote code execution via out-of-memory state corruption", "severity": "critical", "cvss": { "version": "4.0", "score": 9.2, "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, "cwe": [ "CWE-416", "CWE-755", "CWE-824", "CWE-1325", "CWE-1419" ], "published": "2026-10-21", "exploitedInWild": true, "summary": "PHP exits with longjmp() when it runs out of memory. Request memory can be reachable before it is fully initialised, so an out-of-memory error inside that window leaves invalid state that request shutdown later processes as valid. Multipart request parsing, which runs before any application code, can trigger it. Confirmed impact: unauthenticated remote code execution as the web worker account.", "fixSummary": "The fix removes longjmp() for out-of-memory errors, replacing it with a soft limit at the next VM safe point and a hard limit that calls _exit().", "introduced": "5.4.0", "fixed": { "8.2": "8.2.35", "8.3": "8.3.36", "8.4": "8.4.27", "8.5": "8.5.12" }, "eolNote": "PHP 8.1 and older get no official release. The PHP project published minimal source backports for 7.4, 8.0 and 8.1; some distributions and LTS vendors ship them.", "sapis": [ { "sapi": "apache2handler", "label": "Apache mod_php", "status": "Exploit validated", "risk": "highest" }, { "sapi": "fpm-fcgi", "label": "PHP-FPM", "status": "Affected by source analysis; no complete exploit demonstrated", "risk": "high" }, { "sapi": "frankenphp", "label": "FrankenPHP", "status": "Likely affected (source analysis)", "risk": "high" }, { "sapi": "litespeed", "label": "LiteSpeed (LSAPI)", "status": "Likely affected, unvalidated", "risk": "high" }, { "sapi": "cgi-fcgi", "label": "php-cgi", "status": "Serves web requests; treat as affected", "risk": "high" } ], "notes": [ { "kind": "ini", "key": "memory_limit", "value": "-1", "admin": true, "note": "The primary configuration mitigation, and not a complete one. Set it so applications cannot override it (php_admin_value in the FPM pool or Apache config) and restart every worker. One request can then use all memory: watch memory and put the limit back after patching." }, { "kind": "ini", "key": "post_max_size", "value": "8M", "admin": true, "note": "Keep it conservative: 8M without uploads, 32M if uploads are needed. Keep upload_max_filesize below it." }, { "kind": "ini", "key": "max_input_nesting_level", "value": "16", "admin": true, "note": "The advisory recommends reducing it below the default of 64 and bounding input variables, multipart parts, headers per part and uploads." }, { "kind": "webserver", "note": "Enforce limits at the web server or proxy for decoded request size, input field count, multipart part count, header count and nesting depth, including requests with no usable Content-Length. If the application does not use multipart/form-data, block it at the front end." }, { "kind": "donot", "note": "Do not use RLIMIT_AS or RLIMIT_DATA as a substitute. They make mmap() fail, which triggers the vulnerable longjmp() path. A container or cgroup memory.max limit is an availability boundary only." } ], "sources": [ { "label": "php.net release archive and security advisory (2026)", "url": "https://www.php.net/archive/2026.php" }, { "label": "GHSA-w8hw-w9fx-j79w", "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" } ] }, { "id": "php2shell-uaf", "name": "PHP2Shell", "cve": "CVE-2026-109619", "ghsa": "GHSA-6wmf-4rv5-p3rp", "ghsaUrl": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp", "title": "Remote code execution via stale request state (use-after-free)", "severity": "critical", "cvss": { "version": "4.0", "score": 9.2, "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, "cwe": [ "CWE-416" ], "published": "2026-10-21", "exploitedInWild": true, "summary": "Request-owned state (error, session, object and extension state) can stay published in persistent worker globals after the request heap has been freed. If a later request on the same worker touches that state before normal initialisation resets it, the result is a use-after-free. Confirmed impact: unauthenticated memory disclosure and remote code execution as the web worker account.", "fixSummary": "The fix resets all request-owned state when a request is abandoned.", "introduced": "5.4.0", "fixed": { "8.2": "8.2.35", "8.3": "8.3.36", "8.4": "8.4.27", "8.5": "8.5.12" }, "eolNote": "PHP 8.1 and older get no official release. The PHP project published minimal source backports for 7.4, 8.0 and 8.1; some distributions and LTS vendors ship them.", "sapis": [ { "sapi": "apache2handler", "label": "Apache mod_php", "status": "Affected: .htaccess and php_value/php_flag directory settings are applied before request startup", "risk": "highest" }, { "sapi": "fpm-fcgi", "label": "PHP-FPM", "status": "Conditionally exposed when the front end sends PHP_VALUE / PHP_ADMIN_VALUE that produce a diagnostic; session upload progress validated", "risk": "high" }, { "sapi": "litespeed", "label": "LiteSpeed (LSAPI)", "status": "Conditional candidate", "risk": "high" }, { "sapi": "frankenphp", "label": "FrankenPHP", "status": "No early consumer established in the default configuration; not proven immune", "risk": "medium" } ], "notes": [ { "kind": "ini", "key": "session.upload_progress.enabled", "value": "0", "admin": true, "note": "Set it in php.ini, the FPM pool, or server configuration that applies before request parsing, then restart every worker. Do not rely on ini_set() or .user.ini. This blocks the confirmed session paths, not every variant. Keep it off after patching if you do not use the feature." }, { "kind": "ini", "key": "fatal_error_backtraces", "value": "0", "admin": true, "phpOnly": "8.5", "note": "PHP 8.5 only. Removes the producer used by the confirmed RCE case. Restart every worker." }, { "kind": "config", "note": "Remove invalid or deprecated INI settings applied per request that emit diagnostics before startup: auto_detect_line_endings=1, legacy assert.* settings (8.3+), legacy session settings (8.4+), report_memleaks=0 (8.5), and invalid memory_limit or date.timezone values. Turning off error_reporting or display_errors, or using @, does not help." }, { "kind": "config", "note": "Fix fatal errors and execution timeouts that attackers can reach, including failures in callbacks, upload or import processing, and cleanup. Consider pm.max_requests=1 if you can afford the performance cost." }, { "kind": "audit", "note": "Turn on log_errors, a working error_log and error_reporting=E_ALL in startup config to find warnings and fatal errors. An empty log is not proof of safety." } ], "sources": [ { "label": "php.net release archive and security advisory (2026)", "url": "https://www.php.net/archive/2026.php" }, { "label": "GHSA-6wmf-4rv5-p3rp", "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" } ] }, { "id": "php-cgi-bestfit", "name": "PHP-CGI argument injection", "cve": "CVE-2024-4577", "ghsa": "GHSA-3qgc-jrrr-25jv", "ghsaUrl": "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv", "title": "PHP-CGI argument injection on Windows (Best-Fit)", "severity": "critical", "cvss": { "version": "3.1", "score": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "cwe": [ "CWE-88" ], "published": "2024-06-06", "exploitedInWild": true, "kev": true, "summary": "On Windows, the Best-Fit character conversion in some code pages lets a request smuggle command-line arguments into php-cgi, which can lead to source disclosure and remote code execution. It affects php-cgi exposed through Apache ScriptAlias/Action and XAMPP-style setups; mod_php and PHP-FPM are not affected.", "windowsOnly": true, "fixed": { "8.1": "8.1.29", "8.2": "8.2.20", "8.3": "8.3.8" }, "eolNote": "PHP 8.0, 7.x and 5.x are end of life and receive no fix.", "sources": [ { "label": "GHSA-3qgc-jrrr-25jv", "url": "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv" }, { "label": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "session-upload-progress", "name": "Session upload progress", "cve": "CVE-2026-115560", "ghsa": "", "ghsaUrl": "https://www.php.net/archive/2026.php", "title": "Session upload progress with a switched serialize handler", "severity": "medium", "cvss": null, "cwe": [], "published": "2026-10-23", "exploitedInWild": false, "scope": "config", "summary": "An informational advisory from the PHP project, published two days after PHP2Shell, with the full advisory to follow in the next bugfix release. It only matters when an application sets session.serialize_handler to php_binary or php_serialize in configuration and switches it to php at runtime with ini_set() before session_start(). The recommendation is the mitigation PHP2Shell already prescribed: keep session.upload_progress.enabled=0 until the fix ships.", "fixed": {}, "fixedNote": "Fix lands in the next regular bugfix releases; keep the mitigation until then", "notes": [ { "kind": "ini", "key": "session.upload_progress.enabled", "value": "0", "admin": true, "note": "The same setting the PHP2Shell interim mitigations turn off. If you applied it for CVE-2026-109619, keep it in place." } ], "sources": [ { "label": "php.net release archive and security advisory (2026)", "url": "https://www.php.net/archive/2026.php" } ] }, { "id": "http2shell-brotli", "name": "HTTP2Shell", "cve": "CVE-2026-111497", "ghsa": "GHSA-9v8h-qqgm-4m35", "ghsaUrl": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "title": "Brotli decoder out-of-bounds write (node2shell / HTTP2Shell)", "severity": "critical", "cvss": { "version": "4.0", "score": 9.2, "vector": "" }, "cwe": [ "CWE-787", "CWE-252" ], "published": "2026-10-21", "exploitedInWild": false, "scope": "ecosystem", "summary": "Not a PHP engine flaw: an out-of-bounds write in Google's Brotli decoder (libbrotli 1.0.3 through 1.2.0, fixed in 1.2.1) that triggers while decompressing attacker-controlled brotli data, disclosed through Node.js (node2shell) and since shown to reach anything that decodes brotli over HTTP. A PHP host is exposed where brotli decoding happens with the vulnerable library: the PECL brotli extension bundles libbrotli (its latest release, 0.21.0, still ships 1.2.0 with no fixed build yet), and a libcurl built against an unpatched system libbrotli decodes br responses when code asks curl to decompress (CURLOPT_ACCEPT_ENCODING). Upgrade the system libbrotli to 1.2.1 or your distribution's patched package, and disable brotli decoding where no patch exists. A public proof of concept crashes unpatched decoders; it is not in CISA KEV as of 24 October 2026.", "fixed": { "brotli": "1.2.1" }, "fixedNote": "libbrotli 1.2.1 (or your distribution's patched package); no fixed PECL brotli extension release yet", "sources": [ { "label": "google/brotli v1.2.1 release", "url": "https://github.com/google/brotli/releases/tag/v1.2.1" }, { "label": "GHSA-9v8h-qqgm-4m35", "url": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35" }, { "label": "Aikido: node2shell / HTTP2Shell write-up", "url": "https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497" }, { "label": "PECL brotli extension releases", "url": "https://github.com/kjdev/php-ext-brotli/releases" } ] } ] }PK+iX]<3<3 phpshield/data/bip39-english.txtabandon ability able about above absent absorb abstract absurd abuse access accident account accuse achieve acid acoustic acquire across act action actor actress actual adapt add addict address adjust admit adult advance advice aerobic affair afford afraid again age agent agree ahead aim air airport aisle alarm album alcohol alert alien all alley allow almost alone alpha already also alter always amateur amazing among amount amused analyst anchor ancient anger angle angry animal ankle announce annual another answer antenna antique anxiety any apart apology appear apple approve april arch arctic area arena argue arm armed armor army around arrange arrest arrive arrow art artefact artist artwork ask aspect assault asset assist assume asthma athlete atom attack attend attitude attract auction audit august aunt author auto autumn average avocado avoid awake aware away awesome awful awkward axis baby bachelor bacon badge bag balance balcony ball bamboo banana banner bar barely bargain barrel base basic basket battle beach bean beauty because become beef before begin behave behind believe below belt bench benefit best betray better between beyond bicycle bid bike bind biology bird birth bitter black blade blame blanket blast bleak bless blind blood blossom blouse blue blur blush board boat body boil bomb bone bonus book boost border boring borrow boss bottom bounce box boy bracket brain brand brass brave bread breeze brick bridge brief bright bring brisk broccoli broken bronze broom brother brown brush bubble buddy budget buffalo build bulb bulk bullet bundle bunker burden burger burst bus business busy butter buyer buzz cabbage cabin cable cactus cage cake call calm camera camp can canal cancel candy cannon canoe canvas canyon capable capital captain car carbon card cargo carpet carry cart case cash casino castle casual cat catalog catch category cattle caught cause caution cave ceiling celery cement census century cereal certain chair chalk champion change chaos chapter charge chase chat cheap check cheese chef cherry chest chicken chief child chimney choice choose chronic chuckle chunk churn cigar cinnamon circle citizen city civil claim clap clarify claw clay clean clerk clever click client cliff climb clinic clip clock clog close cloth cloud clown club clump cluster clutch coach coast coconut code coffee coil coin collect color column combine come comfort comic common company concert conduct confirm congress connect consider control convince cook cool copper copy coral core corn correct cost cotton couch country couple course cousin cover coyote crack cradle craft cram crane crash crater crawl crazy cream credit creek crew cricket crime crisp critic crop cross crouch crowd crucial cruel cruise crumble crunch crush cry crystal cube culture cup cupboard curious current curtain curve cushion custom cute cycle dad damage damp dance danger daring dash daughter dawn day deal debate debris decade december decide decline decorate decrease deer defense define defy degree delay deliver demand demise denial dentist deny depart depend deposit depth deputy derive describe desert design desk despair destroy detail detect develop device devote diagram dial diamond diary dice diesel diet differ digital dignity dilemma dinner dinosaur direct dirt disagree discover disease dish dismiss disorder display distance divert divide divorce dizzy doctor document dog doll dolphin domain donate donkey donor door dose double dove draft dragon drama drastic draw dream dress drift drill drink drip drive drop drum dry duck dumb dune during dust dutch duty dwarf dynamic eager eagle early earn earth easily east easy echo ecology economy edge edit educate effort egg eight either elbow elder electric elegant element elephant elevator elite else embark embody embrace emerge emotion employ empower empty enable enact end endless endorse enemy energy enforce engage engine enhance enjoy enlist enough enrich enroll ensure enter entire entry envelope episode equal equip era erase erode erosion error erupt escape essay essence estate eternal ethics evidence evil evoke evolve exact example excess exchange excite exclude excuse execute exercise exhaust exhibit exile exist exit exotic expand expect expire explain expose express extend extra eye eyebrow fabric face faculty fade faint faith fall false fame family famous fan fancy fantasy farm fashion fat fatal father fatigue fault favorite feature february federal fee feed feel female fence festival fetch fever few fiber fiction field figure file film filter final find fine finger finish fire firm first fiscal fish fit fitness fix flag flame flash flat flavor flee flight flip float flock floor flower fluid flush fly foam focus fog foil fold follow food foot force forest forget fork fortune forum forward fossil foster found fox fragile frame frequent fresh friend fringe frog front frost frown frozen fruit fuel fun funny furnace fury future gadget gain galaxy gallery game gap garage garbage garden garlic garment gas gasp gate gather gauge gaze general genius genre gentle genuine gesture ghost giant gift giggle ginger giraffe girl give glad glance glare glass glide glimpse globe gloom glory glove glow glue goat goddess gold good goose gorilla gospel gossip govern gown grab grace grain grant grape grass gravity great green grid grief grit grocery group grow grunt guard guess guide guilt guitar gun gym habit hair half hammer hamster hand happy harbor hard harsh harvest hat have hawk hazard head health heart heavy hedgehog height hello helmet help hen hero hidden high hill hint hip hire history hobby hockey hold hole holiday hollow home honey hood hope horn horror horse hospital host hotel hour hover hub huge human humble humor hundred hungry hunt hurdle hurry hurt husband hybrid ice icon idea identify idle ignore ill illegal illness image imitate immense immune impact impose improve impulse inch include income increase index indicate indoor industry infant inflict inform inhale inherit initial inject injury inmate inner innocent input inquiry insane insect inside inspire install intact interest into invest invite involve iron island isolate issue item ivory jacket jaguar jar jazz jealous jeans jelly jewel job join joke journey joy judge juice jump jungle junior junk just kangaroo keen keep ketchup key kick kid kidney kind kingdom kiss kit kitchen kite kitten kiwi knee knife knock know lab label labor ladder lady lake lamp language laptop large later latin laugh laundry lava law lawn lawsuit layer lazy leader leaf learn leave lecture left leg legal legend leisure lemon lend length lens leopard lesson letter level liar liberty library license life lift light like limb limit link lion liquid list little live lizard load loan lobster local lock logic lonely long loop lottery loud lounge love loyal lucky luggage lumber lunar lunch luxury lyrics machine mad magic magnet maid mail main major make mammal man manage mandate mango mansion manual maple marble march margin marine market marriage mask mass master match material math matrix matter maximum maze meadow mean measure meat mechanic medal media melody melt member memory mention menu mercy merge merit merry mesh message metal method middle midnight milk million mimic mind minimum minor minute miracle mirror misery miss mistake mix mixed mixture mobile model modify mom moment monitor monkey monster month moon moral more morning mosquito mother motion motor mountain mouse move movie much muffin mule multiply muscle museum mushroom music must mutual myself mystery myth naive name napkin narrow nasty nation nature near neck need negative neglect neither nephew nerve nest net network neutral never news next nice night noble noise nominee noodle normal north nose notable note nothing notice novel now nuclear number nurse nut oak obey object oblige obscure observe obtain obvious occur ocean october odor off offer office often oil okay old olive olympic omit once one onion online only open opera opinion oppose option orange orbit orchard order ordinary organ orient original orphan ostrich other outdoor outer output outside oval oven over own owner oxygen oyster ozone pact paddle page pair palace palm panda panel panic panther paper parade parent park parrot party pass patch path patient patrol pattern pause pave payment peace peanut pear peasant pelican pen penalty pencil people pepper perfect permit person pet phone photo phrase physical piano picnic picture piece pig pigeon pill pilot pink pioneer pipe pistol pitch pizza place planet plastic plate play please pledge pluck plug plunge poem poet point polar pole police pond pony pool popular portion position possible post potato pottery poverty powder power practice praise predict prefer prepare present pretty prevent price pride primary print priority prison private prize problem process produce profit program project promote proof property prosper protect proud provide public pudding pull pulp pulse pumpkin punch pupil puppy purchase purity purpose purse push put puzzle pyramid quality quantum quarter question quick quit quiz quote rabbit raccoon race rack radar radio rail rain raise rally ramp ranch random range rapid rare rate rather raven raw razor ready real reason rebel rebuild recall receive recipe record recycle reduce reflect reform refuse region regret regular reject relax release relief rely remain remember remind remove render renew rent reopen repair repeat replace report require rescue resemble resist resource response result retire retreat return reunion reveal review reward rhythm rib ribbon rice rich ride ridge rifle right rigid ring riot ripple risk ritual rival river road roast robot robust rocket romance roof rookie room rose rotate rough round route royal rubber rude rug rule run runway rural sad saddle sadness safe sail salad salmon salon salt salute same sample sand satisfy satoshi sauce sausage save say scale scan scare scatter scene scheme school science scissors scorpion scout scrap screen script scrub sea search season seat second secret section security seed seek segment select sell seminar senior sense sentence series service session settle setup seven shadow shaft shallow share shed shell sheriff shield shift shine ship shiver shock shoe shoot shop short shoulder shove shrimp shrug shuffle shy sibling sick side siege sight sign silent silk silly silver similar simple since sing siren sister situate six size skate sketch ski skill skin skirt skull slab slam sleep slender slice slide slight slim slogan slot slow slush small smart smile smoke smooth snack snake snap sniff snow soap soccer social sock soda soft solar soldier solid solution solve someone song soon sorry sort soul sound soup source south space spare spatial spawn speak special speed spell spend sphere spice spider spike spin spirit split spoil sponsor spoon sport spot spray spread spring spy square squeeze squirrel stable stadium staff stage stairs stamp stand start state stay steak steel stem step stereo stick still sting stock stomach stone stool story stove strategy street strike strong struggle student stuff stumble style subject submit subway success such sudden suffer sugar suggest suit summer sun sunny sunset super supply supreme sure surface surge surprise surround survey suspect sustain swallow swamp swap swarm swear sweet swift swim swing switch sword symbol symptom syrup system table tackle tag tail talent talk tank tape target task taste tattoo taxi teach team tell ten tenant tennis tent term test text thank that theme then theory there they thing this thought three thrive throw thumb thunder ticket tide tiger tilt timber time tiny tip tired tissue title toast tobacco today toddler toe together toilet token tomato tomorrow tone tongue tonight tool tooth top topic topple torch tornado tortoise toss total tourist toward tower town toy track trade traffic tragic train transfer trap trash travel tray treat tree trend trial tribe trick trigger trim trip trophy trouble truck true truly trumpet trust truth try tube tuition tumble tuna tunnel turkey turn turtle twelve twenty twice twin twist two type typical ugly umbrella unable unaware uncle uncover under undo unfair unfold unhappy uniform unique unit universe unknown unlock until unusual unveil update upgrade uphold upon upper upset urban urge usage use used useful useless usual utility vacant vacuum vague valid valley valve van vanish vapor various vast vault vehicle velvet vendor venture venue verb verify version very vessel veteran viable vibrant vicious victory video view village vintage violin virtual virus visa visit visual vital vivid vocal voice void volcano volume vote voyage wage wagon wait walk wall walnut want warfare warm warrior wash wasp waste water wave way wealth weapon wear weasel weather web wedding weekend weird welcome west wet whale what wheat wheel when where whip whisper wide width wife wild will win window wine wing wink winner winter wire wisdom wise wish witness wolf woman wonder wood wool word work world worry worth wrap wreck wrestle wrist write wrong yard year yellow you young youth zebra zero zone zoo PK+iX]arrphpshield/data/branches.json{ "_source": "lib/data/branches.ts", "branches": { "5.0": { "initial": "2004-07-13", "activeUntil": null, "securityUntil": "2005-09-05" }, "5.1": { "initial": "2005-11-24", "activeUntil": null, "securityUntil": "2006-08-24" }, "5.2": { "initial": "2006-11-02", "activeUntil": null, "securityUntil": "2011-01-06" }, "5.3": { "initial": "2009-06-30", "activeUntil": null, "securityUntil": "2014-08-14" }, "5.4": { "initial": "2012-03-01", "activeUntil": null, "securityUntil": "2015-09-03" }, "5.5": { "initial": "2013-06-20", "activeUntil": null, "securityUntil": "2016-07-21" }, "5.6": { "initial": "2014-08-28", "activeUntil": null, "securityUntil": "2018-12-31" }, "7.0": { "initial": "2015-12-03", "activeUntil": null, "securityUntil": "2019-01-10" }, "7.1": { "initial": "2016-12-01", "activeUntil": null, "securityUntil": "2019-12-01" }, "7.2": { "initial": "2017-11-30", "activeUntil": null, "securityUntil": "2020-11-30" }, "7.3": { "initial": "2018-12-06", "activeUntil": null, "securityUntil": "2021-12-06" }, "7.4": { "initial": "2019-11-28", "activeUntil": null, "securityUntil": "2022-11-28" }, "8.0": { "initial": "2020-11-26", "activeUntil": null, "securityUntil": "2023-11-26" }, "8.1": { "initial": "2021-11-25", "activeUntil": null, "securityUntil": "2025-12-31" }, "8.2": { "initial": "2022-12-08", "activeUntil": "2024-12-31", "securityUntil": "2026-12-31" }, "8.3": { "initial": "2023-11-23", "activeUntil": "2025-12-31", "securityUntil": "2027-12-31" }, "8.4": { "initial": "2024-11-21", "activeUntil": "2026-12-31", "securityUntil": "2028-12-31" }, "8.5": { "initial": "2025-11-20", "activeUntil": "2027-12-31", "securityUntil": "2029-12-31" } } }PK+iX]Q=phpshield/data/code-rules.json{ "_source": "lib/patterns.ts", "rules": [ { "id": "COMPROMISE-EVAL-DECODER", "severity": "critical", "category": "compromise", "title": "eval() of a decoded or decompressed string (obfuscated code execution)", "re": "\\beval\\s*\\(\\s*(?:base64_decode|gzinflate|gzuncompress|gzdecode|str_rot13|convert_uudecode|rawurldecode|urldecode|hex2bin|strrev)\\s*\\(", "fix": "Treat this host as compromised. Isolate it, preserve the file for forensics, remove it or restore from a known-good backup, then rotate every secret the web worker could read.", "references": [ "https://www.php.net/manual/en/function.eval.php", "https://owasp.org/www-community/attacks/Code_Injection" ], "flags": "i" }, { "id": "COMPROMISE-ASSERT-INPUT", "severity": "critical", "category": "compromise", "title": "assert() fed a decoder, eval or request input (code-execution backdoor)", "re": "\\bassert\\s*\\(\\s*(?:base64_decode|gzinflate|str_rot13|eval|\\$_(?:GET|POST|REQUEST|COOKIE|SERVER))", "fix": "Treat this host as compromised: isolate, preserve, remove or restore, and rotate secrets.", "references": [ "https://www.php.net/manual/en/function.assert.php" ], "flags": "i" }, { "id": "COMPROMISE-EXEC-SUPERGLOBAL", "severity": "critical", "category": "compromise", "title": "Command or code executed directly from request input", "re": "\\b(?:system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|eval|assert)\\s*\\(\\s*(?:stripslashes\\s*\\(\\s*|base64_decode\\s*\\(\\s*|@)?\\$_(?:GET|POST|REQUEST|COOKIE|SERVER)", "fix": "A command or code sink receives a value straight from the request: a command shell over HTTP. Treat this host as compromised; isolate, preserve the file, remove or restore, and rotate secrets.", "references": [ "https://www.php.net/manual/en/function.exec.php", "https://www.php.net/manual/en/function.system.php" ], "flags": "i" }, { "id": "COMPROMISE-DYNAMIC-FUNC-SUPERGLOBAL", "severity": "critical", "category": "compromise", "title": "Function named by request input is being called ($_REQUEST[...](...) backdoor)", "re": "\\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\\s*\\[[^\\]]{1,64}\\]\\s*\\(", "fix": "The function name comes from the request, so any function can be called. Treat as compromised and remove the file.", "references": [ "https://www.php.net/manual/en/functions.variable-functions.php" ], "flags": "i" }, { "id": "COMPROMISE-CALLBACK-SUPERGLOBAL", "severity": "critical", "category": "compromise", "title": "Attacker-controlled callback passed to a dispatcher function", "re": "\\b(?:call_user_func|call_user_func_array|array_map|array_filter|array_walk|register_shutdown_function|usort|uasort|uksort|ob_start)\\s*\\(\\s*(?:@)?\\$_(?:GET|POST|REQUEST|COOKIE|SERVER)", "fix": "A request value is used as a callback name. Treat as compromised and remove the file.", "references": [ "https://www.php.net/manual/en/function.call-user-func.php" ], "flags": "i" }, { "id": "COMPROMISE-CHR-CHAIN", "severity": "high", "category": "compromise", "title": "Character-by-character obfuscation (long chr() concatenation chain)", "re": "(?:chr\\s*\\(\\s*\\d{1,3}\\s*\\)\\s*\\.\\s*){6,}", "fix": "Strings assembled from chr() calls hide function names from grep. Decode the chain offline and treat the file as suspect until proven otherwise.", "references": [ "https://www.php.net/manual/en/function.chr.php" ], "flags": "i" }, { "id": "CODE-EVAL", "severity": "high", "category": "code", "title": "Use of eval()", "re": "\\beval\\s*\\(", "fix": "Remove eval(). Replace dynamic dispatch with an explicit allowlist of callables, and templates with a real template engine.", "references": [ "https://www.php.net/manual/en/function.eval.php" ], "flags": "i" }, { "id": "CODE-SHELL-EXEC", "severity": "medium", "category": "code", "title": "Shell/command execution function", "re": "\\b(?:system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec)\\s*\\(", "fix": "Avoid shelling out from web code. If unavoidable, escapeshellarg() every argument, never pass request data, and add the functions you do not need to disable_functions.", "references": [ "https://www.php.net/manual/en/function.escapeshellarg.php" ], "flags": "i" }, { "id": "CODE-DYNAMIC-INCLUDE", "severity": "medium", "category": "code", "title": "Dynamic include/require with a variable path", "re": "\\b(?:include|include_once|require|require_once)\\s*(?:\\(\\s*)?\\$[a-zA-Z_]", "fix": "Resolve the include path against a fixed allowlist or directory, never from request data; keep allow_url_include off.", "references": [ "https://www.php.net/manual/en/function.include.php" ], "flags": "i" }, { "id": "CODE-UNSERIALIZE", "severity": "medium", "category": "code", "title": "Use of unserialize()", "re": "\\bunserialize\\s*\\(", "fix": "Never unserialize untrusted input. Use JSON, or pass allowed_classes => false.", "references": [ "https://www.php.net/manual/en/function.unserialize.php" ], "flags": "i" }, { "id": "CODE-EXTRACT-REQUEST", "severity": "high", "category": "code", "title": "extract() applied to request input", "re": "\\bextract\\s*\\(\\s*\\$_(?:GET|POST|REQUEST|COOKIE|SERVER|FILES)\\b", "fix": "Remove extract() on superglobals; read the specific keys you need.", "references": [ "https://www.php.net/manual/en/function.extract.php" ], "flags": "i" }, { "id": "CODE-ASSERT-STRING", "severity": "high", "category": "code", "title": "assert() called with a string argument", "re": "\\bassert\\s*\\(\\s*['\"]", "fix": "String assertions were evaluated as code on older PHP. Use expressions, or remove the assert.", "references": [ "https://www.php.net/manual/en/function.assert.php" ], "flags": "i" }, { "id": "CODE-CREATE-FUNCTION", "severity": "medium", "category": "code", "title": "Use of create_function()", "re": "\\bcreate_function\\s*\\(", "fix": "Removed in PHP 8; replace with a closure.", "references": [ "https://www.php.net/manual/en/function.create-function.php" ], "flags": "i" }, { "id": "CODE-PREG-REPLACE-EVAL", "severity": "high", "category": "code", "title": "preg_replace() with the /e (eval) modifier", "re": "preg_replace\\s*\\(\\s*(['\"])\\s*([/#~!|%@])(?:(?!\\2)[^'\"\\\\]|\\\\.)*\\2[imsxADSUXJu]*e[imsxADSUXJu]*\\1", "fix": "Replace with preg_replace_callback(); the /e modifier is removed in PHP 7.", "references": [ "https://www.php.net/manual/en/function.preg-replace-callback.php" ], "flags": "i" } ] }PK+iX], phpshield/data/crypto-rules.json{ "_source": "lib/secrets.ts", "rules": [ { "id": "CRYPTO-ENV-PRIVATE-KEY", "severity": "high", "title": "Private-key variable assigned in a file", "re": "\\b(?:PRIVATE_KEY|PRIVATEKEY|SOLANA_PRIVATE_KEY|SOL_PRIVATE_KEY|WALLET_PRIVATE_KEY|WALLET_SECRET|SECRET_KEY_BASE58|KEYPAIR|SIGNER_KEY|DEPLOYER_KEY|OWNER_PRIVATE_KEY|PAYER_SECRET)\\s*[=:]\\s*['\"]?([^\\s'\"]{16,})", "flags": "g", "fix": "Move the key to a signer service, KMS or HSM. If a PHP worker could read this file, treat the wallet as compromised: move funds and rotate the key.", "references": [ "https://solana.com/docs/intro/wallets" ] }, { "id": "CRYPTO-ENV-MNEMONIC-VAR", "severity": "high", "title": "Seed-phrase variable assigned in a file", "re": "\\b(?:MNEMONIC|SEED_PHRASE|SEEDPHRASE|SECRET_PHRASE|RECOVERY_PHRASE|SECRET_RECOVERY_PHRASE)\\s*[=:]\\s*['\"]?([^\\n'\"]{20,})", "flags": "g", "fix": "A mnemonic restores the whole wallet tree. Move every derived wallet to a fresh seed and never keep a phrase in an environment file.", "references": [ "https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" ] }, { "id": "CRYPTO-RPC-HELIUS", "severity": "high", "title": "Helius RPC URL with an embedded API key", "re": "[a-z0-9.-]*helius[a-z0-9.-]*\\.(?:com|xyz)[^\\s\"'<>]*[?&]api-key=([A-Za-z0-9_-]{6,})", "flags": "gi", "fix": "Rotate the key in the Helius dashboard and load it from a secret store, not a served file.", "references": [ "https://docs.helius.dev/" ] }, { "id": "CRYPTO-RPC-QUICKNODE", "severity": "high", "title": "QuickNode RPC URL with an embedded token", "re": "[a-z0-9.-]+\\.quiknode\\.pro\\/([A-Za-z0-9]{8,})", "flags": "gi", "fix": "Rotate the endpoint token in QuickNode and move it to a secret store.", "references": [ "https://www.quicknode.com/docs" ] }, { "id": "CRYPTO-RPC-ALCHEMY", "severity": "high", "title": "Alchemy RPC URL with an embedded API key", "re": "[a-z0-9.-]*alchemy\\.com\\/v2\\/([A-Za-z0-9_-]{8,})", "flags": "gi", "fix": "Rotate the API key in the Alchemy dashboard.", "references": [ "https://docs.alchemy.com/" ] }, { "id": "CRYPTO-RPC-ANKR", "severity": "high", "title": "Ankr RPC URL with an embedded key", "re": "rpc\\.ankr\\.com\\/[a-z_]+\\/([A-Za-z0-9]{16,})", "flags": "gi", "fix": "Rotate the key in the Ankr dashboard.", "references": [ "https://www.ankr.com/docs/" ] }, { "id": "CRYPTO-RPC-TRITON", "severity": "high", "title": "Triton/rpcpool RPC URL with an embedded token", "re": "[a-z0-9.-]+\\.rpcpool\\.com\\/([A-Za-z0-9]{8,})", "flags": "gi", "fix": "Rotate the token with Triton.", "references": [ "https://docs.triton.one/" ] }, { "id": "CRYPTO-RPC-INFURA", "severity": "high", "title": "Infura RPC URL with an embedded project id", "re": "[a-z0-9.-]*infura\\.io\\/v3\\/([A-Za-z0-9]{16,})", "flags": "gi", "fix": "Rotate the project key in the Infura dashboard.", "references": [ "https://docs.infura.io/" ] }, { "id": "CRYPTO-EXCHANGE-SECRET", "severity": "high", "title": "Exchange API secret assigned in a file", "re": "\\b(?:BINANCE_API_SECRET|BINANCE_SECRET_KEY|COINBASE_API_SECRET|COINBASE_API_KEY|KRAKEN_API_SECRET|KRAKEN_PRIVATE_KEY|BYBIT_API_SECRET|OKX_SECRET_KEY|OKX_API_SECRET|KUCOIN_API_SECRET|BITGET_API_SECRET|GATE_API_SECRET|MEXC_API_SECRET)\\s*[=:]\\s*['\"]?([^\\s'\"]{12,})", "flags": "g", "fix": "Revoke the key pair on the exchange and issue a new one with the narrowest permissions and an IP allowlist.", "references": [ "https://www.binance.com/en/support/faq/360002502072" ] }, { "id": "CRYPTO-DRAINER-SIGN-TRANSFER", "severity": "high", "title": "Wallet sign call paired with transfer construction", "re": "(?:signAllTransactions|signTransaction)\\s*\\([\\s\\S]{0,400}?(?:SystemProgram\\.transfer|createTransferInstruction|createTransferCheckedInstruction)", "flags": "g", "fix": "Front-end code that builds a transfer and asks the wallet to sign it is the shape of a drainer. Confirm it is yours; if not, the served JavaScript was modified.", "references": [ "https://docs.phantom.com/developer-powertools/security" ] }, { "id": "CRYPTO-DRAINER-OBFUSCATED", "severity": "high", "title": "Wallet API used from obfuscated/decoded code", "re": "(?:signTransaction|signAllTransactions|signMessage|solana|phantom)[\\s\\S]{0,300}?(?:atob|String\\.fromCharCode|unescape|eval)\\s*\\(", "flags": "g", "fix": "Wallet calls next to decoding or eval are how injected drainers hide. Diff the served bundle against your build.", "references": [ "https://docs.phantom.com/developer-powertools/security" ] } ] }PK+iX]􌸽GGphpshield/data/ini-rules.json{ "_source": "lib/ini.ts", "rules": [ { "id": "INI-MEMORY-LIMIT-NOT-UNLIMITED", "severity": "info", "key": "memory_limit", "op": "not_equals", "value": "-1", "group": "mitigation", "title": "memory_limit is not set to -1 (PHP2Shell interim mitigation)", "expected": "-1 while unpatched", "why": "An out-of-memory error during request start-up is the trigger for CVE-2026-109618. Removing the limit makes that state less reachable while you roll out the patch. It is not a complete mitigation.", "fix": "php_admin_value[memory_limit] = -1 ; restore a sane limit after patching", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" ] }, { "id": "INI-SESSION-UPLOAD-PROGRESS-ON", "severity": "low", "key": "session.upload_progress.enabled", "op": "truthy", "group": "mitigation", "title": "session.upload_progress.enabled is on (confirmed PHP2Shell path)", "expected": "off", "why": "The session upload-progress feature is one of the confirmed paths for CVE-2026-109619, and the PHP project's follow-up informational advisory of 23 October 2026 (CVE-2026-115560) repeats the same recommendation until its fix ships in the next bugfix release. Turn it off where it applies before request parsing and restart every worker.", "fix": "php_admin_flag[session.upload_progress.enabled] = off", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-POST-MAX-SIZE-LARGE", "severity": "info", "key": "post_max_size", "op": "bytes_gt", "value": "32M", "group": "mitigation", "title": "post_max_size is larger than the PHP2Shell mitigation recommends", "expected": "8M (32M if uploads are needed)", "why": "Smaller request bodies bound what the vulnerable multipart parser has to process.", "fix": "php_admin_value[post_max_size] = 8M", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" ] }, { "id": "INI-POST-MAX-SIZE-UNLIMITED", "severity": "low", "key": "post_max_size", "op": "regex", "value": "^\\s*0+\\s*[kKmMgG]?\\s*$", "group": "mitigation", "title": "post_max_size is 0 (unlimited request body)", "expected": "8M", "why": "An unlimited body lets a single request drive the parser as far as it likes.", "fix": "php_admin_value[post_max_size] = 8M", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" ] }, { "id": "INI-MAX-INPUT-NESTING-HIGH", "severity": "info", "key": "max_input_nesting_level", "op": "bytes_gt", "value": "16", "group": "mitigation", "title": "max_input_nesting_level is above the PHP2Shell mitigation value", "expected": "16", "why": "The advisory recommends reducing nesting below the default of 64 and bounding input variables and multipart parts.", "fix": "php_admin_value[max_input_nesting_level] = 16", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" ] }, { "id": "INI-FATAL-ERROR-BACKTRACES-ON", "severity": "low", "key": "fatal_error_backtraces", "op": "truthy", "group": "mitigation", "title": "fatal_error_backtraces is on (PHP 8.5 PHP2Shell mitigation)", "expected": "0 on PHP 8.5", "why": "On 8.5 this is the producer used by the confirmed RCE case for CVE-2026-109619.", "fix": "php_admin_value[fatal_error_backtraces] = 0", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-AUTO-DETECT-LINE-ENDINGS-ON", "severity": "low", "key": "auto_detect_line_endings", "op": "truthy", "group": "diagnostic", "title": "auto_detect_line_endings is on and deprecated (per-request diagnostic)", "expected": "unset", "why": "A deprecated setting applied per request emits a diagnostic before start-up, one of the triggers behind CVE-2026-109619.", "fix": "; remove auto_detect_line_endings from per-request config", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-REPORT-MEMLEAKS-OFF", "severity": "low", "key": "report_memleaks", "op": "falsy", "group": "diagnostic", "title": "report_memleaks=0 set on PHP 8.5 (deprecated; per-request diagnostic)", "expected": "unset on 8.5", "why": "Deprecated on 8.5; set per request it emits a start-up diagnostic.", "fix": "; remove report_memleaks", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-ASSERT-ACTIVE-SET", "severity": "low", "key": "assert.active", "op": "present", "group": "diagnostic", "title": "Legacy assert.active set (deprecated since PHP 8.3)", "expected": "unset", "why": "Legacy assert.* settings are deprecated since 8.3 and emit a diagnostic when applied per request.", "fix": "; remove assert.active", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-ASSERT-BAIL-SET", "severity": "low", "key": "assert.bail", "op": "present", "group": "diagnostic", "title": "Legacy assert.bail set (deprecated since PHP 8.3)", "expected": "unset", "why": "Legacy assert.* settings are deprecated since 8.3 and emit a diagnostic when applied per request.", "fix": "; remove assert.bail", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-ASSERT-WARNING-SET", "severity": "low", "key": "assert.warning", "op": "present", "group": "diagnostic", "title": "Legacy assert.warning set (deprecated since PHP 8.3)", "expected": "unset", "why": "Legacy assert.* settings are deprecated since 8.3 and emit a diagnostic when applied per request.", "fix": "; remove assert.warning", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-ASSERT-EXCEPTION-SET", "severity": "low", "key": "assert.exception", "op": "present", "group": "diagnostic", "title": "Legacy assert.exception set (deprecated since PHP 8.3)", "expected": "unset", "why": "Legacy assert.* settings are deprecated since 8.3 and emit a diagnostic when applied per request.", "fix": "; remove assert.exception", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-ASSERT-CALLBACK-SET", "severity": "low", "key": "assert.callback", "op": "present", "group": "diagnostic", "title": "Legacy assert.callback set (deprecated since PHP 8.3)", "expected": "unset", "why": "Legacy assert.* settings are deprecated since 8.3 and emit a diagnostic when applied per request.", "fix": "; remove assert.callback", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-SESSION-SID_LENGTH-SET", "severity": "low", "key": "session.sid_length", "op": "present", "group": "diagnostic", "title": "session.sid_length changed (deprecated since PHP 8.4)", "expected": "unset", "why": "Legacy session settings are deprecated since 8.4 and emit a diagnostic when applied per request.", "fix": "; remove session.sid_length", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-SESSION-SID_BITS_PER_CHARACTER-SET", "severity": "low", "key": "session.sid_bits_per_character", "op": "present", "group": "diagnostic", "title": "session.sid_bits_per_character changed (deprecated since PHP 8.4)", "expected": "unset", "why": "Legacy session settings are deprecated since 8.4 and emit a diagnostic when applied per request.", "fix": "; remove session.sid_bits_per_character", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-SESSION-USE_TRANS_SID-SET", "severity": "low", "key": "session.use_trans_sid", "op": "present", "group": "diagnostic", "title": "session.use_trans_sid changed (deprecated since PHP 8.4)", "expected": "unset", "why": "Legacy session settings are deprecated since 8.4 and emit a diagnostic when applied per request.", "fix": "; remove session.use_trans_sid", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-SESSION-TRANS_SID_TAGS-SET", "severity": "low", "key": "session.trans_sid_tags", "op": "present", "group": "diagnostic", "title": "session.trans_sid_tags changed (deprecated since PHP 8.4)", "expected": "unset", "why": "Legacy session settings are deprecated since 8.4 and emit a diagnostic when applied per request.", "fix": "; remove session.trans_sid_tags", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-SESSION-TRANS_SID_HOSTS-SET", "severity": "low", "key": "session.trans_sid_hosts", "op": "present", "group": "diagnostic", "title": "session.trans_sid_hosts changed (deprecated since PHP 8.4)", "expected": "unset", "why": "Legacy session settings are deprecated since 8.4 and emit a diagnostic when applied per request.", "fix": "; remove session.trans_sid_hosts", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-SESSION-REFERER-CHECK-SET", "severity": "low", "key": "session.referer_check", "op": "not_empty", "group": "diagnostic", "title": "session.referer_check changed (deprecated since PHP 8.4)", "expected": "unset", "why": "Deprecated since 8.4; emits a diagnostic when applied per request.", "fix": "; remove session.referer_check", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-INVALID-MEMORY-LIMIT", "severity": "low", "key": "memory_limit", "op": "regex", "value": "[0-9]\\s*[kmg]b", "group": "diagnostic", "title": "memory_limit uses an invalid byte unit (MB/GB/KB)", "expected": "128M style shorthand (K, M, G)", "why": "PHP accepts K, M and G; an invalid value emits a start-up diagnostic.", "fix": "memory_limit = 128M", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp", "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-INVALID-DATE-TIMEZONE", "severity": "low", "key": "date.timezone", "op": "regex", "value": "[+]|\\s", "group": "diagnostic", "title": "date.timezone looks invalid (offset or whitespace)", "expected": "an IANA zone such as Europe/Athens", "why": "An invalid timezone emits a start-up diagnostic.", "fix": "date.timezone = UTC", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-LOG-ERRORS-OFF", "severity": "low", "key": "log_errors", "op": "falsy", "group": "diagnostic", "title": "log_errors is off (hides PHP2Shell diagnostics)", "expected": "On", "why": "With logging off you cannot find the warnings and fatal errors an attacker could reach.", "fix": "log_errors = On\nerror_reporting = E_ALL\nerror_log = /var/log/php/error.log", "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "INI-ALLOW-URL-INCLUDE-ON", "severity": "high", "key": "allow_url_include", "op": "truthy", "group": "hardening", "title": "allow_url_include is on (remote file inclusion to RCE)", "expected": "Off", "why": "Lets include/require load code over HTTP; with any injection it becomes remote code execution.", "fix": "allow_url_include = Off", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-ALLOW-URL-FOPEN-ON", "severity": "low", "key": "allow_url_fopen", "op": "truthy", "group": "hardening", "title": "allow_url_fopen is on", "expected": "Off unless the app needs it", "why": "Enables URL wrappers in file functions, a common SSRF and exfiltration helper after compromise.", "fix": "allow_url_fopen = Off", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-DISPLAY-ERRORS-ON", "severity": "medium", "key": "display_errors", "op": "truthy", "group": "hardening", "title": "display_errors is on (information disclosure)", "expected": "Off", "why": "Prints stack traces and paths to visitors.", "fix": "display_errors = Off", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-DISPLAY-STARTUP-ERRORS-ON", "severity": "medium", "key": "display_startup_errors", "op": "truthy", "group": "hardening", "title": "display_startup_errors is on (information disclosure)", "expected": "Off", "why": "Start-up errors are shown to visitors.", "fix": "display_startup_errors = Off", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-EXPOSE-PHP-ON", "severity": "low", "key": "expose_php", "op": "truthy", "group": "hardening", "title": "expose_php is on (version fingerprinting)", "expected": "Off", "why": "Sends X-Powered-By with your exact PHP version, which scanners use to pick targets.", "fix": "expose_php = Off", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-OPEN-BASEDIR-EMPTY", "severity": "low", "key": "open_basedir", "op": "empty", "group": "hardening", "title": "open_basedir is set but empty", "expected": "the application root", "why": "Restricts which paths PHP may open; it limits what a webshell can read, including keys outside the web root.", "fix": "open_basedir = /var/www/app:/tmp", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-DISABLE-FUNCTIONS-EMPTY", "severity": "low", "key": "disable_functions", "op": "empty", "group": "hardening", "title": "disable_functions is set but empty", "expected": "exec, passthru, shell_exec, system, proc_open, popen (as the app allows)", "why": "Disabling shell functions removes the easiest payloads a webshell relies on.", "fix": "disable_functions = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-SESSION-COOKIE-HTTPONLY-OFF", "severity": "medium", "key": "session.cookie_httponly", "op": "falsy", "group": "hardening", "title": "session.cookie_httponly is off (cookie readable by JavaScript)", "expected": "1", "why": "HttpOnly keeps the session cookie away from injected scripts.", "fix": "session.cookie_httponly = 1", "references": [ "https://www.php.net/manual/en/session.configuration.php" ] }, { "id": "INI-SESSION-COOKIE-SECURE-OFF", "severity": "low", "key": "session.cookie_secure", "op": "falsy", "group": "hardening", "title": "session.cookie_secure is off (cookie may travel over HTTP)", "expected": "1", "why": "Secure restricts the cookie to HTTPS.", "fix": "session.cookie_secure = 1", "references": [ "https://www.php.net/manual/en/session.configuration.php" ] }, { "id": "INI-SESSION-COOKIE-SAMESITE-EMPTY", "severity": "low", "key": "session.cookie_samesite", "op": "empty", "group": "hardening", "title": "session.cookie_samesite is not set", "expected": "Lax or Strict", "why": "SameSite limits cross-site request forgery with the session cookie.", "fix": "session.cookie_samesite = Lax", "references": [ "https://www.php.net/manual/en/session.configuration.php" ] }, { "id": "INI-SESSION-USE-STRICT-MODE-OFF", "severity": "medium", "key": "session.use_strict_mode", "op": "falsy", "group": "hardening", "title": "session.use_strict_mode is off (session fixation)", "expected": "1", "why": "Rejects uninitialised session IDs, which defeats session fixation.", "fix": "session.use_strict_mode = 1", "references": [ "https://www.php.net/manual/en/session.configuration.php" ] }, { "id": "INI-CGI-FIX-PATHINFO-ON", "severity": "medium", "key": "cgi.fix_pathinfo", "op": "truthy", "group": "hardening", "title": "cgi.fix_pathinfo is on (unintended files may execute as PHP)", "expected": "0", "why": "With a loose nginx location block, uploaded files such as image.jpg/x.php execute as PHP.", "fix": "cgi.fix_pathinfo = 0", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-ENABLE-DL-ON", "severity": "medium", "key": "enable_dl", "op": "truthy", "group": "hardening", "title": "enable_dl is on (runtime extension loading)", "expected": "Off", "why": "dl() loads arbitrary shared objects into the worker; with code execution it is a direct escalation.", "fix": "enable_dl = Off", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-FILE-UPLOADS-ON", "severity": "info", "key": "file_uploads", "op": "truthy", "group": "hardening", "title": "file_uploads is on", "expected": "Off unless the app accepts uploads", "why": "Uploads are the classic way a webshell lands on disk; turn them off if nothing uses them.", "fix": "file_uploads = Off", "references": [ "https://www.php.net/manual/en/ini.core.php" ] }, { "id": "INI-UPLOAD-GT-POST", "severity": "medium", "key": "upload_max_filesize", "op": "bytes_gt", "value": "@post_max_size", "group": "hardening", "title": "upload_max_filesize is larger than post_max_size", "expected": "below post_max_size", "why": "post_max_size caps the whole request, so uploads larger than it can never succeed and the mismatch hides the real limit.", "fix": "upload_max_filesize = 2M\npost_max_size = 8M", "references": [ "https://www.php.net/manual/en/ini.core.php" ] } ] }PK+iX]bI phpshield/data/php-releases.json{ "schema": 1, "generatedAt": "2026-10-22T19:46:34.867Z", "sources": { "releases": "https://www.php.net/releases/index.php?json", "supported": "https://www.php.net/supported-versions.php" }, "branches": { "5.6": { "latest": "5.6.40", "latestDate": "2019-01-09", "count": 41, "security": [] }, "5.5": { "latest": "5.5.38", "latestDate": "2016-07-20", "count": 39, "security": [] }, "5.4": { "latest": "5.4.45", "latestDate": "2015-09-02", "count": 46, "security": [] }, "5.3": { "latest": "5.3.29", "latestDate": "2014-08-13", "count": 30, "security": [] }, "5.2": { "latest": "5.2.17", "latestDate": "2011-01-05", "count": 17, "security": [] }, "5.1": { "latest": "5.1.6", "latestDate": "2006-08-23", "count": 7, "security": [] }, "5.0": { "latest": "5.0.5", "latestDate": "2005-09-04", "count": 6, "security": [] }, "7.4": { "latest": "7.4.33", "latestDate": "2022-11-02", "count": 32, "security": [ "7.4.2", "7.4.3", "7.4.4", "7.4.5", "7.4.6", "7.4.8", "7.4.9", "7.4.23", "7.4.24", "7.4.25", "7.4.26", "7.4.28", "7.4.29", "7.4.30", "7.4.32", "7.4.33" ] }, "7.3": { "latest": "7.3.33", "latestDate": "2021-11-17", "count": 34, "security": [ "7.3.1", "7.3.3", "7.3.4", "7.3.5", "7.3.6", "7.3.8", "7.3.9", "7.3.10", "7.3.11", "7.3.13", "7.3.14", "7.3.15", "7.3.16", "7.3.17", "7.3.18", "7.3.20", "7.3.21", "7.3.26", "7.3.27", "7.3.28", "7.3.29", "7.3.30", "7.3.31", "7.3.32", "7.3.33" ] }, "7.2": { "latest": "7.2.34", "latestDate": "2020-09-30", "count": 35, "security": [ "7.2.3", "7.2.4", "7.2.5", "7.2.8", "7.2.10", "7.2.13", "7.2.14", "7.2.16", "7.2.17", "7.2.18", "7.2.19", "7.2.21", "7.2.22", "7.2.24", "7.2.26", "7.2.27", "7.2.28", "7.2.29", "7.2.30", "7.2.31", "7.2.32", "7.2.33", "7.2.34" ] }, "7.1": { "latest": "7.1.33", "latestDate": "2019-10-23", "count": 34, "security": [ "7.1.7", "7.1.15", "7.1.16", "7.1.17", "7.1.20", "7.1.22", "7.1.25", "7.1.26", "7.1.27", "7.1.28", "7.1.29", "7.1.30", "7.1.31", "7.1.32", "7.1.33" ] }, "7.0": { "latest": "7.0.33", "latestDate": "2019-01-09", "count": 34, "security": [ "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7", "7.0.8", "7.0.9", "7.0.10", "7.0.11", "7.0.12", "7.0.13", "7.0.14", "7.0.15", "7.0.21", "7.0.25", "7.0.27", "7.0.28", "7.0.29", "7.0.30", "7.0.31", "7.0.32", "7.0.33" ] }, "8.5": { "latest": "8.5.12", "latestDate": "2026-10-20", "count": 13, "security": [ "8.5.1", "8.5.6", "8.5.8", "8.5.9", "8.5.11", "8.5.12" ] }, "8.4": { "latest": "8.4.27", "latestDate": "2026-10-20", "count": 26, "security": [ "8.4.1", "8.4.5", "8.4.10", "8.4.16", "8.4.21", "8.4.23", "8.4.24", "8.4.26", "8.4.27" ] }, "8.3": { "latest": "8.3.36", "latestDate": "2026-10-20", "count": 34, "security": [ "8.3.6", "8.3.8", "8.3.12", "8.3.14", "8.3.19", "8.3.23", "8.3.29", "8.3.31", "8.3.32", "8.3.33", "8.3.35", "8.3.36" ] }, "8.2": { "latest": "8.2.35", "latestDate": "2026-10-20", "count": 36, "security": [ "8.2.1", "8.2.3", "8.2.7", "8.2.9", "8.2.18", "8.2.20", "8.2.24", "8.2.26", "8.2.28", "8.2.29", "8.2.30", "8.2.31", "8.2.32", "8.2.33", "8.2.34", "8.2.35" ] }, "8.1": { "latest": "8.1.34", "latestDate": "2025-12-17", "count": 35, "security": [ "8.1.3", "8.1.7", "8.1.8", "8.1.11", "8.1.12", "8.1.14", "8.1.16", "8.1.20", "8.1.22", "8.1.28", "8.1.29", "8.1.30", "8.1.31", "8.1.32", "8.1.33", "8.1.34" ] }, "8.0": { "latest": "8.0.30", "latestDate": "2023-08-02", "count": 30, "security": [ "8.0.10", "8.0.11", "8.0.12", "8.0.13", "8.0.16", "8.0.20", "8.0.23", "8.0.24", "8.0.25", "8.0.27", "8.0.28", "8.0.29", "8.0.30" ] } }, "releases": { "5.6.40": { "branch": "5.6", "date": "2019-01-09", "security": false }, "5.6.39": { "branch": "5.6", "date": "2018-12-05", "security": false }, "5.6.38": { "branch": "5.6", "date": "2018-09-12", "security": false }, "5.6.37": { "branch": "5.6", "date": "2018-07-18", "security": false }, "5.6.36": { "branch": "5.6", "date": "2018-04-25", "security": false }, "5.6.35": { "branch": "5.6", "date": "2018-03-28", "security": false }, "5.6.34": { "branch": "5.6", "date": "2018-02-28", "security": false }, "5.6.33": { "branch": "5.6", "date": "2018-01-03", "security": false }, "5.6.32": { "branch": "5.6", "date": "2017-10-25", "security": false }, "5.6.31": { "branch": "5.6", "date": "2017-07-05", "security": false }, "5.6.30": { "branch": "5.6", "date": "2017-01-18", "security": false }, "5.6.29": { "branch": "5.6", "date": "2016-12-07", "security": false }, "5.6.28": { "branch": "5.6", "date": "2016-11-09", "security": false }, "5.6.27": { "branch": "5.6", "date": "2016-10-12", "security": false }, "5.6.26": { "branch": "5.6", "date": "2016-09-14", "security": false }, "5.6.25": { "branch": "5.6", "date": "2016-08-17", "security": false }, "5.6.24": { "branch": "5.6", "date": "2016-07-20", "security": false }, "5.5.38": { "branch": "5.5", "date": "2016-07-20", "security": false }, "5.6.23": { "branch": "5.6", "date": "2016-06-22", "security": false }, "5.5.37": { "branch": "5.5", "date": "2016-06-22", "security": false }, "5.5.36": { "branch": "5.5", "date": "2016-05-25", "security": false }, "5.6.22": { "branch": "5.6", "date": "2016-05-25", "security": false }, "5.6.21": { "branch": "5.6", "date": "2016-04-27", "security": false }, "5.5.35": { "branch": "5.5", "date": "2016-03-30", "security": false }, "5.6.20": { "branch": "5.6", "date": "2016-03-30", "security": false }, "5.5.34": { "branch": "5.5", "date": "2016-03-30", "security": false }, "5.6.19": { "branch": "5.6", "date": "2016-03-02", "security": false }, "5.5.33": { "branch": "5.5", "date": "2016-03-02", "security": false }, "5.6.18": { "branch": "5.6", "date": "2016-02-03", "security": false }, "5.5.32": { "branch": "5.5", "date": "2016-02-03", "security": false }, "5.6.17": { "branch": "5.6", "date": "2016-01-06", "security": false }, "5.5.31": { "branch": "5.5", "date": "2016-01-06", "security": false }, "5.6.16": { "branch": "5.6", "date": "2015-11-25", "security": false }, "5.5.30": { "branch": "5.5", "date": "2015-09-30", "security": false }, "5.6.15": { "branch": "5.6", "date": "2015-10-28", "security": false }, "5.6.14": { "branch": "5.6", "date": "2015-09-30", "security": false }, "5.6.13": { "branch": "5.6", "date": "2015-09-02", "security": false }, "5.5.29": { "branch": "5.5", "date": "2015-09-02", "security": false }, "5.5.28": { "branch": "5.5", "date": "2015-08-05", "security": false }, "5.6.12": { "branch": "5.6", "date": "2015-08-05", "security": false }, "5.6.11": { "branch": "5.6", "date": "2015-07-09", "security": false }, "5.5.27": { "branch": "5.5", "date": "2015-07-08", "security": false }, "5.6.10": { "branch": "5.6", "date": "2015-06-10", "security": false }, "5.5.26": { "branch": "5.5", "date": "2015-06-10", "security": false }, "5.6.9": { "branch": "5.6", "date": "2015-05-13", "security": false }, "5.5.25": { "branch": "5.5", "date": "2015-05-13", "security": false }, "5.6.8": { "branch": "5.6", "date": "2015-04-15", "security": false }, "5.5.24": { "branch": "5.5", "date": "2015-04-15", "security": false }, "5.6.7": { "branch": "5.6", "date": "2015-03-18", "security": false }, "5.5.23": { "branch": "5.5", "date": "2015-02-19", "security": false }, "5.6.6": { "branch": "5.6", "date": "2015-02-18", "security": false }, "5.5.22": { "branch": "5.5", "date": "2015-02-19", "security": false }, "5.6.5": { "branch": "5.6", "date": "2015-01-21", "security": false }, "5.5.21": { "branch": "5.5", "date": "2015-01-21", "security": false }, "5.6.4": { "branch": "5.6", "date": "2014-12-17", "security": false }, "5.5.20": { "branch": "5.5", "date": "2014-12-17", "security": false }, "5.6.3": { "branch": "5.6", "date": "2014-11-12", "security": false }, "5.5.19": { "branch": "5.5", "date": "2014-11-12", "security": false }, "5.6.2": { "branch": "5.6", "date": "2014-10-15", "security": false }, "5.5.18": { "branch": "5.5", "date": "2014-10-15", "security": false }, "5.6.1": { "branch": "5.6", "date": "2014-10-01", "security": false }, "5.5.17": { "branch": "5.5", "date": "2014-09-17", "security": false }, "5.6.0": { "branch": "5.6", "date": "2014-08-27", "security": false }, "5.5.16": { "branch": "5.5", "date": "2014-08-20", "security": false }, "5.5.15": { "branch": "5.5", "date": "2014-07-23", "security": false }, "5.5.14": { "branch": "5.5", "date": "2014-06-25", "security": false }, "5.5.13": { "branch": "5.5", "date": "2014-05-28", "security": false }, "5.5.12": { "branch": "5.5", "date": "2014-04-29", "security": false }, "5.5.11": { "branch": "5.5", "date": "2014-04-02", "security": false }, "5.5.10": { "branch": "5.5", "date": "2014-03-05", "security": false }, "5.5.9": { "branch": "5.5", "date": "2014-02-05", "security": false }, "5.5.8": { "branch": "5.5", "date": "2014-01-08", "security": false }, "5.5.7": { "branch": "5.5", "date": "2013-12-11", "security": false }, "5.5.6": { "branch": "5.5", "date": "2013-11-13", "security": false }, "5.5.5": { "branch": "5.5", "date": "2013-10-16", "security": false }, "5.5.4": { "branch": "5.5", "date": "2013-09-18", "security": false }, "5.5.3": { "branch": "5.5", "date": "2013-08-21", "security": false }, "5.5.2": { "branch": "5.5", "date": "2013-08-14", "security": false }, "5.5.1": { "branch": "5.5", "date": "2013-07-17", "security": false }, "5.5.0": { "branch": "5.5", "date": "2013-06-19", "security": false }, "5.4.45": { "branch": "5.4", "date": "2015-09-02", "security": false }, "5.4.44": { "branch": "5.4", "date": "2015-08-05", "security": false }, "5.4.43": { "branch": "5.4", "date": "2015-07-08", "security": false }, "5.4.42": { "branch": "5.4", "date": "2015-06-10", "security": false }, "5.4.41": { "branch": "5.4", "date": "2015-05-13", "security": false }, "5.4.40": { "branch": "5.4", "date": "2015-04-15", "security": false }, "5.4.39": { "branch": "5.4", "date": "2015-03-18", "security": false }, "5.4.38": { "branch": "5.4", "date": "2015-02-18", "security": false }, "5.4.37": { "branch": "5.4", "date": "2015-01-21", "security": false }, "5.4.36": { "branch": "5.4", "date": "2014-12-17", "security": false }, "5.4.35": { "branch": "5.4", "date": "2014-11-12", "security": false }, "5.4.34": { "branch": "5.4", "date": "2014-10-15", "security": false }, "5.4.33": { "branch": "5.4", "date": "2014-09-17", "security": false }, "5.4.32": { "branch": "5.4", "date": "2014-08-20", "security": false }, "5.4.31": { "branch": "5.4", "date": "2014-07-23", "security": false }, "5.4.30": { "branch": "5.4", "date": "2014-06-25", "security": false }, "5.4.29": { "branch": "5.4", "date": "2014-05-28", "security": false }, "5.4.28": { "branch": "5.4", "date": "2014-05-01", "security": false }, "5.4.27": { "branch": "5.4", "date": "2014-04-02", "security": false }, "5.4.26": { "branch": "5.4", "date": "2014-03-05", "security": false }, "5.4.25": { "branch": "5.4", "date": "2014-02-05", "security": false }, "5.4.24": { "branch": "5.4", "date": "2014-01-08", "security": false }, "5.4.23": { "branch": "5.4", "date": "2013-12-11", "security": false }, "5.4.22": { "branch": "5.4", "date": "2013-11-13", "security": false }, "5.4.21": { "branch": "5.4", "date": "2013-10-16", "security": false }, "5.4.20": { "branch": "5.4", "date": "2013-09-18", "security": false }, "5.4.19": { "branch": "5.4", "date": "2013-08-21", "security": false }, "5.4.18": { "branch": "5.4", "date": "2013-07-03", "security": false }, "5.4.17": { "branch": "5.4", "date": "2013-07-03", "security": false }, "5.4.16": { "branch": "5.4", "date": "2013-05-08", "security": false }, "5.4.15": { "branch": "5.4", "date": "2013-05-08", "security": false }, "5.4.14": { "branch": "5.4", "date": "2013-04-10", "security": false }, "5.4.13": { "branch": "5.4", "date": "2013-03-13", "security": false }, "5.4.12": { "branch": "5.4", "date": "2013-02-20", "security": false }, "5.4.11": { "branch": "5.4", "date": "2013-01-16", "security": false }, "5.4.10": { "branch": "5.4", "date": "2012-12-19", "security": false }, "5.4.9": { "branch": "5.4", "date": "2012-11-21", "security": false }, "5.4.8": { "branch": "5.4", "date": "2012-10-17", "security": false }, "5.4.7": { "branch": "5.4", "date": "2012-09-12", "security": false }, "5.4.6": { "branch": "5.4", "date": "2012-08-15", "security": false }, "5.4.5": { "branch": "5.4", "date": "2012-07-18", "security": false }, "5.4.4": { "branch": "5.4", "date": "2012-06-13", "security": false }, "5.4.3": { "branch": "5.4", "date": "2012-05-07", "security": false }, "5.4.2": { "branch": "5.4", "date": "2012-05-02", "security": false }, "5.4.1": { "branch": "5.4", "date": "2012-04-25", "security": false }, "5.4.0": { "branch": "5.4", "date": "2012-02-29", "security": false }, "5.3.29": { "branch": "5.3", "date": "2014-08-13", "security": false }, "5.3.28": { "branch": "5.3", "date": "2013-07-10", "security": false }, "5.3.27": { "branch": "5.3", "date": "2013-07-10", "security": false }, "5.3.26": { "branch": "5.3", "date": "2013-06-05", "security": false }, "5.3.25": { "branch": "5.3", "date": "2013-05-08", "security": false }, "5.3.24": { "branch": "5.3", "date": "2013-04-10", "security": false }, "5.3.23": { "branch": "5.3", "date": "2013-03-13", "security": false }, "5.3.22": { "branch": "5.3", "date": "2013-02-20", "security": false }, "5.3.21": { "branch": "5.3", "date": "2013-01-16", "security": false }, "5.3.20": { "branch": "5.3", "date": "2012-12-19", "security": false }, "5.3.19": { "branch": "5.3", "date": "2012-11-21", "security": false }, "5.3.18": { "branch": "5.3", "date": "2012-10-17", "security": false }, "5.3.17": { "branch": "5.3", "date": "2012-09-12", "security": false }, "5.3.16": { "branch": "5.3", "date": "2012-08-15", "security": false }, "5.3.15": { "branch": "5.3", "date": "2012-07-18", "security": false }, "5.3.14": { "branch": "5.3", "date": "2012-06-13", "security": false }, "5.3.13": { "branch": "5.3", "date": "2012-05-07", "security": false }, "5.3.12": { "branch": "5.3", "date": "2012-05-02", "security": false }, "5.3.11": { "branch": "5.3", "date": "2012-04-25", "security": false }, "5.3.10": { "branch": "5.3", "date": "2012-02-01", "security": false }, "5.3.9": { "branch": "5.3", "date": "2012-01-09", "security": false }, "5.3.8": { "branch": "5.3", "date": "2011-08-22", "security": false }, "5.3.7": { "branch": "5.3", "date": "2011-08-17", "security": false }, "5.3.6": { "branch": "5.3", "date": "2011-03-18", "security": false }, "5.3.5": { "branch": "5.3", "date": "2011-01-05", "security": false }, "5.3.4": { "branch": "5.3", "date": "2010-12-08", "security": false }, "5.2.17": { "branch": "5.2", "date": "2011-01-05", "security": false }, "5.2.16": { "branch": "5.2", "date": "2010-12-15", "security": false }, "5.2.15": { "branch": "5.2", "date": "2010-12-08", "security": false }, "5.3.3": { "branch": "5.3", "date": "2010-07-21", "security": false }, "5.2.14": { "branch": "5.2", "date": "2010-07-21", "security": false }, "5.3.2": { "branch": "5.3", "date": "2010-03-03", "security": false }, "5.2.13": { "branch": "5.2", "date": "2010-02-24", "security": false }, "5.3.1": { "branch": "5.3", "date": "2009-11-18", "security": false }, "5.2.12": { "branch": "5.2", "date": "2009-12-16", "security": false }, "5.2.11": { "branch": "5.2", "date": "2009-09-16", "security": false }, "5.3.0": { "branch": "5.3", "date": "2009-06-29", "security": false }, "5.2.10": { "branch": "5.2", "date": "2009-06-17", "security": false }, "5.2.9": { "branch": "5.2", "date": "2009-02-25", "security": false }, "5.2.8": { "branch": "5.2", "date": "2008-12-07", "security": false }, "5.2.6": { "branch": "5.2", "date": "2008-04-30", "security": false }, "5.2.5": { "branch": "5.2", "date": "2007-11-07", "security": false }, "5.2.4": { "branch": "5.2", "date": "2007-08-29", "security": false }, "5.2.3": { "branch": "5.2", "date": "2007-05-30", "security": false }, "5.2.2": { "branch": "5.2", "date": "2007-05-02", "security": false }, "5.2.1": { "branch": "5.2", "date": "2007-02-07", "security": false }, "5.2.0": { "branch": "5.2", "date": "2006-11-01", "security": false }, "5.1.6": { "branch": "5.1", "date": "2006-08-23", "security": false }, "5.1.5": { "branch": "5.1", "date": "2006-08-16", "security": false }, "5.1.4": { "branch": "5.1", "date": "2006-05-03", "security": false }, "5.1.3": { "branch": "5.1", "date": "2006-05-01", "security": false }, "5.1.2": { "branch": "5.1", "date": "2006-01-11", "security": false }, "5.1.1": { "branch": "5.1", "date": "2005-11-27", "security": false }, "5.1.0": { "branch": "5.1", "date": "2005-11-23", "security": false }, "5.0.5": { "branch": "5.0", "date": "2005-09-04", "security": false }, "5.0.4": { "branch": "5.0", "date": "2005-03-30", "security": false }, "5.0.3": { "branch": "5.0", "date": "2004-12-14", "security": false }, "5.0.2": { "branch": "5.0", "date": "2004-09-22", "security": false }, "5.0.1": { "branch": "5.0", "date": "2004-08-11", "security": false }, "5.0.0": { "branch": "5.0", "date": "2004-07-12", "security": false }, "7.4.33": { "branch": "7.4", "date": "2022-11-02", "security": true }, "7.4.32": { "branch": "7.4", "date": "2022-09-28", "security": true }, "7.4.30": { "branch": "7.4", "date": "2022-06-08", "security": true }, "7.4.29": { "branch": "7.4", "date": "2022-04-13", "security": true }, "7.4.28": { "branch": "7.4", "date": "2022-02-16", "security": true }, "7.4.27": { "branch": "7.4", "date": "2021-12-15", "security": false }, "7.4.26": { "branch": "7.4", "date": "2021-11-17", "security": true }, "7.3.33": { "branch": "7.3", "date": "2021-11-17", "security": true }, "7.3.32": { "branch": "7.3", "date": "2021-10-27", "security": true }, "7.4.25": { "branch": "7.4", "date": "2021-10-20", "security": true }, "7.3.31": { "branch": "7.3", "date": "2021-09-22", "security": true }, "7.4.24": { "branch": "7.4", "date": "2021-09-22", "security": true }, "7.4.23": { "branch": "7.4", "date": "2021-08-25", "security": true }, "7.3.30": { "branch": "7.3", "date": "2021-08-25", "security": true }, "7.4.22": { "branch": "7.4", "date": "2021-07-28", "security": false }, "7.3.29": { "branch": "7.3", "date": "2021-06-30", "security": true }, "7.4.21": { "branch": "7.4", "date": "2021-06-30", "security": false }, "7.4.20": { "branch": "7.4", "date": "2021-06-02", "security": false }, "7.3.28": { "branch": "7.3", "date": "2021-04-28", "security": true }, "7.4.19": { "branch": "7.4", "date": "2021-05-05", "security": false }, "7.4.18": { "branch": "7.4", "date": "2021-04-28", "security": false }, "7.4.16": { "branch": "7.4", "date": "2021-03-03", "security": false }, "7.3.27": { "branch": "7.3", "date": "2021-02-03", "security": true }, "7.4.15": { "branch": "7.4", "date": "2021-02-03", "security": false }, "7.4.14": { "branch": "7.4", "date": "2021-01-06", "security": false }, "7.3.26": { "branch": "7.3", "date": "2021-01-06", "security": true }, "7.3.25": { "branch": "7.3", "date": "2020-11-25", "security": false }, "7.4.13": { "branch": "7.4", "date": "2020-11-25", "security": false }, "7.2.34": { "branch": "7.2", "date": "2020-09-30", "security": true }, "7.3.24": { "branch": "7.3", "date": "2020-10-28", "security": false }, "7.4.12": { "branch": "7.4", "date": "2020-10-28", "security": false }, "7.4.11": { "branch": "7.4", "date": "2020-09-30", "security": false }, "7.3.23": { "branch": "7.3", "date": "2020-09-30", "security": false }, "7.3.22": { "branch": "7.3", "date": "2020-09-02", "security": false }, "7.4.10": { "branch": "7.4", "date": "2020-09-02", "security": false }, "7.2.33": { "branch": "7.2", "date": "2020-08-05", "security": true }, "7.4.9": { "branch": "7.4", "date": "2020-08-05", "security": true }, "7.3.21": { "branch": "7.3", "date": "2020-08-05", "security": true }, "7.4.8": { "branch": "7.4", "date": "2020-07-08", "security": true }, "7.3.20": { "branch": "7.3", "date": "2020-07-08", "security": true }, "7.2.32": { "branch": "7.2", "date": "2020-07-08", "security": true }, "7.4.7": { "branch": "7.4", "date": "2020-06-10", "security": false }, "7.2.31": { "branch": "7.2", "date": "2020-05-13", "security": true }, "7.3.19": { "branch": "7.3", "date": "2020-06-10", "security": false }, "7.4.6": { "branch": "7.4", "date": "2020-05-13", "security": true }, "7.3.18": { "branch": "7.3", "date": "2020-05-13", "security": true }, "7.4.5": { "branch": "7.4", "date": "2020-04-15", "security": true }, "7.3.17": { "branch": "7.3", "date": "2020-04-15", "security": true }, "7.2.30": { "branch": "7.2", "date": "2020-04-15", "security": true }, "7.2.29": { "branch": "7.2", "date": "2020-03-18", "security": true }, "7.4.4": { "branch": "7.4", "date": "2020-03-18", "security": true }, "7.3.16": { "branch": "7.3", "date": "2020-03-18", "security": true }, "7.4.3": { "branch": "7.4", "date": "2020-02-19", "security": true }, "7.2.28": { "branch": "7.2", "date": "2020-02-19", "security": true }, "7.3.15": { "branch": "7.3", "date": "2020-02-19", "security": true }, "7.4.2": { "branch": "7.4", "date": "2020-01-22", "security": true }, "7.3.14": { "branch": "7.3", "date": "2020-01-22", "security": true }, "7.2.27": { "branch": "7.2", "date": "2020-01-22", "security": true }, "7.3.13": { "branch": "7.3", "date": "2019-12-17", "security": true }, "7.2.26": { "branch": "7.2", "date": "2019-12-17", "security": true }, "7.4.1": { "branch": "7.4", "date": "2019-12-17", "security": false }, "7.2.25": { "branch": "7.2", "date": "2019-11-20", "security": false }, "7.3.12": { "branch": "7.3", "date": "2019-11-20", "security": false }, "7.4.0": { "branch": "7.4", "date": "2019-11-27", "security": false }, "7.1.33": { "branch": "7.1", "date": "2019-10-23", "security": true }, "7.2.24": { "branch": "7.2", "date": "2019-10-23", "security": true }, "7.3.11": { "branch": "7.3", "date": "2019-10-23", "security": true }, "7.1.32": { "branch": "7.1", "date": "2019-08-28", "security": true }, "7.3.10": { "branch": "7.3", "date": "2019-09-25", "security": true }, "7.2.23": { "branch": "7.2", "date": "2019-09-25", "security": false }, "7.2.22": { "branch": "7.2", "date": "2019-08-28", "security": true }, "7.3.9": { "branch": "7.3", "date": "2019-08-28", "security": true }, "7.1.31": { "branch": "7.1", "date": "2019-07-31", "security": true }, "7.2.21": { "branch": "7.2", "date": "2019-07-31", "security": true }, "7.3.8": { "branch": "7.3", "date": "2019-07-31", "security": true }, "7.1.30": { "branch": "7.1", "date": "2019-05-29", "security": true }, "7.2.20": { "branch": "7.2", "date": "2019-07-03", "security": false }, "7.3.7": { "branch": "7.3", "date": "2019-07-03", "security": false }, "7.2.19": { "branch": "7.2", "date": "2019-05-29", "security": true }, "7.3.6": { "branch": "7.3", "date": "2019-05-29", "security": true }, "7.1.29": { "branch": "7.1", "date": "2019-05-01", "security": true }, "7.2.18": { "branch": "7.2", "date": "2019-05-29", "security": true }, "7.3.5": { "branch": "7.3", "date": "2019-05-01", "security": true }, "7.1.28": { "branch": "7.1", "date": "2019-05-01", "security": true }, "7.2.17": { "branch": "7.2", "date": "2019-05-01", "security": true }, "7.3.4": { "branch": "7.3", "date": "2019-04-03", "security": true }, "7.1.27": { "branch": "7.1", "date": "2019-03-06", "security": true }, "7.2.16": { "branch": "7.2", "date": "2019-04-03", "security": true }, "7.3.3": { "branch": "7.3", "date": "2019-03-06", "security": true }, "7.1.26": { "branch": "7.1", "date": "2019-01-09", "security": true }, "7.2.15": { "branch": "7.2", "date": "2019-03-06", "security": false }, "7.3.2": { "branch": "7.3", "date": "2019-02-06", "security": false }, "7.2.14": { "branch": "7.2", "date": "2019-02-06", "security": true }, "7.3.1": { "branch": "7.3", "date": "2019-01-09", "security": true }, "7.0.33": { "branch": "7.0", "date": "2019-01-09", "security": true }, "7.1.25": { "branch": "7.1", "date": "2018-12-05", "security": true }, "7.3.0": { "branch": "7.3", "date": "2018-12-05", "security": false }, "7.2.13": { "branch": "7.2", "date": "2018-12-05", "security": true }, "7.0.32": { "branch": "7.0", "date": "2018-09-12", "security": true }, "7.1.24": { "branch": "7.1", "date": "2018-11-07", "security": false }, "7.2.12": { "branch": "7.2", "date": "2018-11-07", "security": false }, "7.1.23": { "branch": "7.1", "date": "2018-10-10", "security": false }, "7.2.11": { "branch": "7.2", "date": "2018-10-10", "security": false }, "7.1.22": { "branch": "7.1", "date": "2018-09-12", "security": true }, "7.2.10": { "branch": "7.2", "date": "2018-09-12", "security": true }, "7.1.21": { "branch": "7.1", "date": "2018-09-12", "security": false }, "7.0.31": { "branch": "7.0", "date": "2018-07-18", "security": true }, "7.2.9": { "branch": "7.2", "date": "2018-08-15", "security": false }, "7.1.20": { "branch": "7.1", "date": "2018-08-15", "security": true }, "7.2.8": { "branch": "7.2", "date": "2018-07-18", "security": true }, "7.1.19": { "branch": "7.1", "date": "2018-06-20", "security": false }, "7.0.30": { "branch": "7.0", "date": "2018-04-25", "security": true }, "7.2.7": { "branch": "7.2", "date": "2018-06-20", "security": false }, "7.1.18": { "branch": "7.1", "date": "2018-05-23", "security": false }, "7.2.6": { "branch": "7.2", "date": "2018-05-23", "security": false }, "7.1.17": { "branch": "7.1", "date": "2018-04-25", "security": true }, "7.2.5": { "branch": "7.2", "date": "2018-04-25", "security": true }, "7.1.16": { "branch": "7.1", "date": "2018-03-28", "security": true }, "7.0.29": { "branch": "7.0", "date": "2018-03-28", "security": true }, "7.2.4": { "branch": "7.2", "date": "2018-03-28", "security": true }, "7.1.15": { "branch": "7.1", "date": "2018-02-28", "security": true }, "7.2.3": { "branch": "7.2", "date": "2018-02-28", "security": true }, "7.0.28": { "branch": "7.0", "date": "2018-02-28", "security": true }, "7.1.14": { "branch": "7.1", "date": "2018-01-31", "security": false }, "7.2.2": { "branch": "7.2", "date": "2018-01-31", "security": false }, "7.0.27": { "branch": "7.0", "date": "2018-01-03", "security": true }, "7.2.1": { "branch": "7.2", "date": "2018-01-03", "security": false }, "7.1.13": { "branch": "7.1", "date": "2018-01-03", "security": false }, "7.2.0": { "branch": "7.2", "date": "2017-11-29", "security": false }, "7.1.12": { "branch": "7.1", "date": "2017-11-22", "security": false }, "7.0.26": { "branch": "7.0", "date": "2017-11-22", "security": false }, "7.1.11": { "branch": "7.1", "date": "2017-10-25", "security": false }, "7.0.25": { "branch": "7.0", "date": "2017-10-25", "security": true }, "7.1.10": { "branch": "7.1", "date": "2017-09-27", "security": false }, "7.0.24": { "branch": "7.0", "date": "2017-09-27", "security": false }, "7.1.9": { "branch": "7.1", "date": "2017-08-30", "security": false }, "7.0.23": { "branch": "7.0", "date": "2017-08-30", "security": false }, "7.1.8": { "branch": "7.1", "date": "2017-08-02", "security": false }, "7.0.22": { "branch": "7.0", "date": "2017-08-02", "security": false }, "7.1.7": { "branch": "7.1", "date": "2017-07-05", "security": true }, "7.0.21": { "branch": "7.0", "date": "2017-07-05", "security": true }, "7.1.6": { "branch": "7.1", "date": "2017-06-07", "security": false }, "7.0.20": { "branch": "7.0", "date": "2017-06-07", "security": false }, "7.1.5": { "branch": "7.1", "date": "2017-05-10", "security": false }, "7.0.19": { "branch": "7.0", "date": "2017-05-10", "security": false }, "7.1.4": { "branch": "7.1", "date": "2017-04-12", "security": false }, "7.0.18": { "branch": "7.0", "date": "2017-04-12", "security": false }, "7.1.3": { "branch": "7.1", "date": "2017-03-15", "security": false }, "7.0.17": { "branch": "7.0", "date": "2017-03-29", "security": false }, "7.1.2": { "branch": "7.1", "date": "2017-02-15", "security": false }, "7.0.16": { "branch": "7.0", "date": "2017-02-15", "security": false }, "7.1.1": { "branch": "7.1", "date": "2017-01-18", "security": false }, "7.0.15": { "branch": "7.0", "date": "2017-01-18", "security": true }, "7.0.14": { "branch": "7.0", "date": "2016-12-07", "security": true }, "7.1.0": { "branch": "7.1", "date": "2016-11-30", "security": false }, "7.0.13": { "branch": "7.0", "date": "2016-11-09", "security": true }, "7.0.12": { "branch": "7.0", "date": "2016-10-12", "security": true }, "7.0.11": { "branch": "7.0", "date": "2016-09-14", "security": true }, "7.0.10": { "branch": "7.0", "date": "2016-08-17", "security": true }, "7.0.9": { "branch": "7.0", "date": "2016-07-20", "security": true }, "7.0.8": { "branch": "7.0", "date": "2016-06-22", "security": true }, "7.0.7": { "branch": "7.0", "date": "2016-05-25", "security": true }, "7.0.6": { "branch": "7.0", "date": "2016-04-27", "security": true }, "7.0.5": { "branch": "7.0", "date": "2016-03-30", "security": true }, "7.0.4": { "branch": "7.0", "date": "2016-03-02", "security": true }, "7.0.3": { "branch": "7.0", "date": "2016-02-03", "security": true }, "7.0.2": { "branch": "7.0", "date": "2016-01-06", "security": true }, "7.0.1": { "branch": "7.0", "date": "2015-12-16", "security": false }, "7.0.0": { "branch": "7.0", "date": "2015-12-02", "security": false }, "8.5.12": { "branch": "8.5", "date": "2026-10-20", "security": true }, "8.4.27": { "branch": "8.4", "date": "2026-10-20", "security": true }, "8.3.36": { "branch": "8.3", "date": "2026-10-20", "security": true }, "8.2.35": { "branch": "8.2", "date": "2026-10-20", "security": true }, "8.5.11": { "branch": "8.5", "date": "2026-09-23", "security": true }, "8.4.26": { "branch": "8.4", "date": "2026-09-23", "security": true }, "8.3.35": { "branch": "8.3", "date": "2026-09-23", "security": true }, "8.2.34": { "branch": "8.2", "date": "2026-09-23", "security": true }, "8.4.25": { "branch": "8.4", "date": "2026-08-26", "security": false }, "8.2.33": { "branch": "8.2", "date": "2026-07-29", "security": true }, "8.5.10": { "branch": "8.5", "date": "2026-08-26", "security": false }, "8.3.33": { "branch": "8.3", "date": "2026-07-29", "security": true }, "8.5.9": { "branch": "8.5", "date": "2026-07-29", "security": true }, "8.4.24": { "branch": "8.4", "date": "2026-07-29", "security": true }, "8.4.23": { "branch": "8.4", "date": "2026-07-01", "security": true }, "8.3.32": { "branch": "8.3", "date": "2026-07-01", "security": true }, "8.5.8": { "branch": "8.5", "date": "2026-07-01", "security": true }, "8.2.32": { "branch": "8.2", "date": "2026-07-01", "security": true }, "8.5.7": { "branch": "8.5", "date": "2026-06-03", "security": false }, "8.4.22": { "branch": "8.4", "date": "2026-06-03", "security": false }, "8.3.31": { "branch": "8.3", "date": "2026-05-06", "security": true }, "8.2.31": { "branch": "8.2", "date": "2026-05-06", "security": true }, "8.4.21": { "branch": "8.4", "date": "2026-05-06", "security": true }, "8.5.6": { "branch": "8.5", "date": "2026-05-06", "security": true }, "8.5.5": { "branch": "8.5", "date": "2026-04-08", "security": false }, "8.2.30": { "branch": "8.2", "date": "2025-12-17", "security": true }, "8.4.20": { "branch": "8.4", "date": "2026-04-08", "security": false }, "8.3.30": { "branch": "8.3", "date": "2026-01-14", "security": false }, "8.4.19": { "branch": "8.4", "date": "2026-03-11", "security": false }, "8.5.4": { "branch": "8.5", "date": "2026-03-11", "security": false }, "8.5.3": { "branch": "8.5", "date": "2026-02-11", "security": false }, "8.4.18": { "branch": "8.4", "date": "2026-02-11", "security": false }, "8.5.2": { "branch": "8.5", "date": "2026-01-14", "security": false }, "8.4.17": { "branch": "8.4", "date": "2026-01-14", "security": false }, "8.5.1": { "branch": "8.5", "date": "2025-12-17", "security": true }, "8.3.29": { "branch": "8.3", "date": "2025-12-17", "security": true }, "8.4.16": { "branch": "8.4", "date": "2025-12-17", "security": true }, "8.1.34": { "branch": "8.1", "date": "2025-12-17", "security": true }, "8.1.33": { "branch": "8.1", "date": "2025-07-02", "security": true }, "8.4.15": { "branch": "8.4", "date": "2025-11-19", "security": false }, "8.2.29": { "branch": "8.2", "date": "2025-07-02", "security": true }, "8.3.28": { "branch": "8.3", "date": "2025-11-19", "security": false }, "8.5.0": { "branch": "8.5", "date": "2025-11-19", "security": false }, "8.4.14": { "branch": "8.4", "date": "2025-10-22", "security": false }, "8.3.27": { "branch": "8.3", "date": "2025-10-22", "security": false }, "8.3.26": { "branch": "8.3", "date": "2025-09-24", "security": false }, "8.4.13": { "branch": "8.4", "date": "2025-09-24", "security": false }, "8.3.25": { "branch": "8.3", "date": "2025-08-27", "security": false }, "8.4.12": { "branch": "8.4", "date": "2025-08-27", "security": false }, "8.3.24": { "branch": "8.3", "date": "2025-07-30", "security": false }, "8.4.11": { "branch": "8.4", "date": "2025-07-30", "security": false }, "8.4.10": { "branch": "8.4", "date": "2025-07-02", "security": true }, "8.3.23": { "branch": "8.3", "date": "2025-07-02", "security": true }, "8.3.22": { "branch": "8.3", "date": "2025-06-04", "security": false }, "8.1.32": { "branch": "8.1", "date": "2025-03-12", "security": true }, "8.2.28": { "branch": "8.2", "date": "2025-03-12", "security": true }, "8.4.8": { "branch": "8.4", "date": "2025-06-04", "security": false }, "8.3.21": { "branch": "8.3", "date": "2025-05-07", "security": false }, "8.4.7": { "branch": "8.4", "date": "2025-05-07", "security": false }, "8.3.20": { "branch": "8.3", "date": "2025-04-09", "security": false }, "8.4.6": { "branch": "8.4", "date": "2025-04-09", "security": false }, "8.4.5": { "branch": "8.4", "date": "2025-03-12", "security": true }, "8.3.19": { "branch": "8.3", "date": "2025-03-12", "security": true }, "8.2.27": { "branch": "8.2", "date": "2024-12-18", "security": false }, "8.1.31": { "branch": "8.1", "date": "2024-11-20", "security": true }, "8.4.4": { "branch": "8.4", "date": "2025-02-12", "security": false }, "8.3.17": { "branch": "8.3", "date": "2025-02-12", "security": false }, "8.3.16": { "branch": "8.3", "date": "2025-01-15", "security": false }, "8.4.3": { "branch": "8.4", "date": "2025-01-15", "security": false }, "8.4.2": { "branch": "8.4", "date": "2024-12-18", "security": false }, "8.3.15": { "branch": "8.3", "date": "2024-12-18", "security": false }, "8.4.1": { "branch": "8.4", "date": "2024-11-20", "security": true }, "8.3.14": { "branch": "8.3", "date": "2024-11-20", "security": true }, "8.2.26": { "branch": "8.2", "date": "2024-11-20", "security": true }, "8.1.30": { "branch": "8.1", "date": "2024-09-25", "security": true }, "8.3.13": { "branch": "8.3", "date": "2024-10-23", "security": false }, "8.2.25": { "branch": "8.2", "date": "2024-10-23", "security": false }, "8.2.24": { "branch": "8.2", "date": "2024-09-25", "security": true }, "8.3.12": { "branch": "8.3", "date": "2024-09-25", "security": true }, "8.1.29": { "branch": "8.1", "date": "2024-06-05", "security": true }, "8.2.23": { "branch": "8.2", "date": "2024-08-28", "security": false }, "8.3.11": { "branch": "8.3", "date": "2024-08-28", "security": false }, "8.3.10": { "branch": "8.3", "date": "2024-07-31", "security": false }, "8.2.22": { "branch": "8.2", "date": "2024-07-31", "security": false }, "8.2.21": { "branch": "8.2", "date": "2024-07-03", "security": false }, "8.3.9": { "branch": "8.3", "date": "2024-07-03", "security": false }, "8.3.8": { "branch": "8.3", "date": "2024-06-05", "security": true }, "8.2.20": { "branch": "8.2", "date": "2024-06-05", "security": true }, "8.2.19": { "branch": "8.2", "date": "2024-05-08", "security": false }, "8.3.7": { "branch": "8.3", "date": "2024-05-08", "security": false }, "8.1.28": { "branch": "8.1", "date": "2024-04-10", "security": true }, "8.3.6": { "branch": "8.3", "date": "2024-04-10", "security": true }, "8.2.18": { "branch": "8.2", "date": "2024-04-10", "security": true }, "8.1.27": { "branch": "8.1", "date": "2023-12-20", "security": false }, "8.3.4": { "branch": "8.3", "date": "2024-03-13", "security": false }, "8.2.17": { "branch": "8.2", "date": "2024-03-13", "security": false }, "8.3.3": { "branch": "8.3", "date": "2024-02-14", "security": false }, "8.2.16": { "branch": "8.2", "date": "2024-02-14", "security": false }, "8.2.15": { "branch": "8.2", "date": "2024-01-17", "security": false }, "8.3.2": { "branch": "8.3", "date": "2024-01-17", "security": false }, "8.2.14": { "branch": "8.2", "date": "2023-12-20", "security": false }, "8.3.1": { "branch": "8.3", "date": "2023-12-20", "security": false }, "8.2.13": { "branch": "8.2", "date": "2023-11-22", "security": false }, "8.1.26": { "branch": "8.1", "date": "2023-11-22", "security": false }, "8.3.0": { "branch": "8.3", "date": "2023-11-22", "security": false }, "8.0.30": { "branch": "8.0", "date": "2023-08-02", "security": true }, "8.1.25": { "branch": "8.1", "date": "2023-10-25", "security": false }, "8.2.12": { "branch": "8.2", "date": "2023-10-25", "security": false }, "8.1.24": { "branch": "8.1", "date": "2023-09-27", "security": false }, "8.2.11": { "branch": "8.2", "date": "2023-09-27", "security": false }, "8.1.23": { "branch": "8.1", "date": "2023-08-30", "security": false }, "8.2.10": { "branch": "8.2", "date": "2023-08-30", "security": false }, "8.1.22": { "branch": "8.1", "date": "2023-08-02", "security": true }, "8.2.9": { "branch": "8.2", "date": "2023-08-02", "security": true }, "8.2.8": { "branch": "8.2", "date": "2023-07-05", "security": false }, "8.0.29": { "branch": "8.0", "date": "2023-06-07", "security": true }, "8.1.21": { "branch": "8.1", "date": "2023-07-05", "security": false }, "8.1.20": { "branch": "8.1", "date": "2023-06-07", "security": true }, "8.2.7": { "branch": "8.2", "date": "2023-06-07", "security": true }, "8.1.19": { "branch": "8.1", "date": "2023-05-10", "security": false }, "8.2.6": { "branch": "8.2", "date": "2023-05-10", "security": false }, "8.0.28": { "branch": "8.0", "date": "2023-02-13", "security": true }, "8.1.18": { "branch": "8.1", "date": "2023-04-12", "security": false }, "8.2.5": { "branch": "8.2", "date": "2023-04-12", "security": false }, "8.1.17": { "branch": "8.1", "date": "2023-03-15", "security": false }, "8.2.4": { "branch": "8.2", "date": "2023-03-15", "security": false }, "8.2.3": { "branch": "8.2", "date": "2023-02-13", "security": true }, "8.1.16": { "branch": "8.1", "date": "2023-02-13", "security": true }, "8.1.15": { "branch": "8.1", "date": "2023-02-01", "security": false }, "8.2.2": { "branch": "8.2", "date": "2023-02-01", "security": false }, "8.0.27": { "branch": "8.0", "date": "2023-01-04", "security": true }, "8.1.14": { "branch": "8.1", "date": "2023-01-04", "security": true }, "8.2.1": { "branch": "8.2", "date": "2023-01-04", "security": true }, "8.0.26": { "branch": "8.0", "date": "2022-11-23", "security": false }, "8.2.0": { "branch": "8.2", "date": "2022-12-07", "security": false }, "8.1.13": { "branch": "8.1", "date": "2022-11-23", "security": false }, "8.0.25": { "branch": "8.0", "date": "2022-10-26", "security": true }, "8.1.12": { "branch": "8.1", "date": "2022-10-26", "security": true }, "8.1.11": { "branch": "8.1", "date": "2022-09-28", "security": true }, "8.0.24": { "branch": "8.0", "date": "2022-09-28", "security": true }, "8.0.23": { "branch": "8.0", "date": "2022-08-31", "security": true }, "8.1.10": { "branch": "8.1", "date": "2022-08-31", "security": false }, "8.0.22": { "branch": "8.0", "date": "2022-08-03", "security": false }, "8.1.9": { "branch": "8.1", "date": "2022-08-03", "security": false }, "8.1.8": { "branch": "8.1", "date": "2022-07-06", "security": true }, "8.0.21": { "branch": "8.0", "date": "2022-07-06", "security": false }, "8.1.7": { "branch": "8.1", "date": "2022-06-08", "security": true }, "8.0.20": { "branch": "8.0", "date": "2022-06-08", "security": true }, "8.0.19": { "branch": "8.0", "date": "2022-05-11", "security": false }, "8.1.6": { "branch": "8.1", "date": "2022-05-11", "security": false }, "8.1.5": { "branch": "8.1", "date": "2022-04-13", "security": false }, "8.0.18": { "branch": "8.0", "date": "2022-04-13", "security": false }, "8.0.17": { "branch": "8.0", "date": "2022-03-16", "security": false }, "8.1.4": { "branch": "8.1", "date": "2022-03-16", "security": false }, "8.1.3": { "branch": "8.1", "date": "2022-02-16", "security": true }, "8.0.16": { "branch": "8.0", "date": "2022-02-16", "security": true }, "8.1.2": { "branch": "8.1", "date": "2022-01-19", "security": false }, "8.0.15": { "branch": "8.0", "date": "2022-01-19", "security": false }, "8.1.1": { "branch": "8.1", "date": "2021-12-15", "security": false }, "8.0.14": { "branch": "8.0", "date": "2021-12-15", "security": false }, "8.1.0": { "branch": "8.1", "date": "2021-11-24", "security": false }, "8.0.13": { "branch": "8.0", "date": "2021-11-17", "security": true }, "8.0.12": { "branch": "8.0", "date": "2021-10-20", "security": true }, "8.0.11": { "branch": "8.0", "date": "2021-09-22", "security": true }, "8.0.10": { "branch": "8.0", "date": "2021-08-25", "security": true }, "8.0.9": { "branch": "8.0", "date": "2021-07-28", "security": false }, "8.0.8": { "branch": "8.0", "date": "2021-06-30", "security": false }, "8.0.7": { "branch": "8.0", "date": "2021-06-02", "security": false }, "8.0.6": { "branch": "8.0", "date": "2021-05-05", "security": false }, "8.0.5": { "branch": "8.0", "date": "2021-04-28", "security": false }, "8.0.3": { "branch": "8.0", "date": "2021-03-03", "security": false }, "8.0.2": { "branch": "8.0", "date": "2021-02-03", "security": false }, "8.0.1": { "branch": "8.0", "date": "2021-01-06", "security": false }, "8.0.0": { "branch": "8.0", "date": "2020-11-25", "security": false } } }PK+iX]b|zphpshield/data/platforms.json{ "_source": "lib/data/platforms.ts", "sapi_labels": { "fpm-fcgi": "PHP-FPM", "apache2handler": "Apache mod_php", "cli": "CLI / cron", "cgi-fcgi": "php-cgi (CGI / FastCGI)", "litespeed": "LiteSpeed (LSAPI)", "frankenphp": "FrankenPHP" }, "mitigations_intro": "These reduce exposure while you roll out the upgrade. php.net is explicit that they are not complete: \"There are no complete mitigations, updating is the only safe choice.\" Apply them as php_admin_value / php_admin_flag (FPM pool) or php_admin_value (Apache) so applications cannot override them, then restart every worker. Remove the ones you do not otherwise want once every worker runs the patched build.", "platforms": [ { "id": "ubuntu-ondrej", "name": "Ubuntu (ondrej/php PPA)", "group": "Linux packages", "sapis": [ "fpm-fcgi", "apache2handler", "cli", "cgi-fcgi" ], "detect": { "osReleaseIds": [ "ubuntu" ], "paths": [ "/etc/apt/sources.list.d/ondrej-*" ] }, "steps": [ { "title": "Refresh the package lists", "commands": [ "sudo apt-get update" ] }, { "title": "Upgrade the installed PHP {branch} packages", "commands": [ "sudo apt-get install --only-upgrade 'php{branch}*'" ], "note": "--only-upgrade touches only php{branch} packages that are already installed. The ondrej/php PPA ships the fixed build; if apt reports no candidate, confirm the PPA is enabled and the fixed version is visible with apt-cache policy php{branch}-fpm." } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo systemctl restart php{branch}-fpm" ] }, { "sapis": [ "apache2handler" ], "commands": [ "sudo systemctl restart apache2" ], "note": "mod_php lives inside the Apache process, so Apache itself has to restart." }, { "sapis": [ "cgi-fcgi" ], "commands": [ "sudo systemctl restart apache2" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php{branch} -v", "php{branch} -r 'echo PHP_VERSION, PHP_EOL;'" ], "notes": [ "Confirm the reported version is {version} or newer.", "If several PHP branches are installed, repeat for each; update-alternatives --list php shows which binary php resolves to." ], "references": [ "https://launchpad.net/~ondrej/+archive/ubuntu/php", "https://www.php.net/archive/2026.php" ] }, { "id": "ubuntu-debian-distro", "name": "Ubuntu / Debian (distribution packages)", "group": "Linux packages", "sapis": [ "fpm-fcgi", "apache2handler", "cli", "cgi-fcgi" ], "detect": { "osReleaseIds": [ "ubuntu", "debian" ] }, "steps": [ { "title": "Refresh the package lists", "commands": [ "sudo apt-get update" ] }, { "title": "Upgrade PHP from the distribution's own repository", "commands": [ "sudo apt-get install --only-upgrade php php-cli php-fpm php-common", "sudo apt-get install --only-upgrade 'php{branch}*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo systemctl restart php{branch}-fpm" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo systemctl restart apache2" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php -v", "php{branch} -v" ], "notes": [ "Distribution packages backport the security fix into the branch they ship, so the reported patch number may differ from php.net's while still containing the fix. Verify with the vendor advisory or apt-get changelog php{branch}.", "Debian 12 (bookworm) ships 8.2 and Debian 11 (bullseye) ships 7.4; for a newer branch use packages.sury.org or the ondrej PPA." ], "references": [ "https://www.php.net/archive/2026.php", "https://wiki.debian.org/PHP", "https://ubuntu.com/server/docs" ] }, { "id": "debian-sury", "name": "Debian (packages.sury.org)", "group": "Linux packages", "sapis": [ "fpm-fcgi", "apache2handler", "cli", "cgi-fcgi" ], "detect": { "osReleaseIds": [ "debian" ], "paths": [ "/etc/apt/sources.list.d/*sury*" ] }, "steps": [ { "title": "Refresh the package lists", "commands": [ "sudo apt-get update" ] }, { "title": "Upgrade the installed PHP {branch} packages", "commands": [ "sudo apt-get install --only-upgrade 'php{branch}*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo systemctl restart php{branch}-fpm" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo systemctl restart apache2" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php{branch} -v" ], "notes": [ "The Sury repository is a third-party build (not official Debian) with patches of its own; the PHP project has no control over it. Do not remove it as a source afterwards or the PHP packages can break.", "Confirm the reported version is {version} or newer." ], "references": [ "https://deb.sury.org/", "https://packages.sury.org/php/", "https://wiki.debian.org/AdditionalPHPVersions" ] }, { "id": "rhel-appstream", "name": "RHEL / AlmaLinux / Rocky (AppStream module)", "group": "Linux packages", "sapis": [ "fpm-fcgi", "apache2handler", "cli", "cgi-fcgi" ], "detect": { "osReleaseIds": [ "rhel", "almalinux", "rocky", "centos" ] }, "steps": [ { "title": "Check which module stream is enabled", "commands": [ "sudo dnf module list php" ] }, { "title": "Update the PHP packages in that stream", "commands": [ "sudo dnf upgrade --refresh php php-cli php-fpm php-common" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo systemctl restart php-fpm" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo systemctl restart httpd" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php -v", "php -r 'echo PHP_VERSION, PHP_EOL;'" ], "notes": [ "The distro module backports the fix, so the reported patch number may differ from php.net's while still containing the fix; confirm against your vendor's advisory.", "To move to a newer branch instead: sudo dnf module reset php, then sudo dnf module enable php:{branch} (distro streams) or a Remi stream, then upgrade." ], "references": [ "https://www.php.net/archive/2026.php", "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_basic_system_settings/assembly_installing-and-using-dynamic-programming-languages_configuring-basic-system-settings", "https://almalinux.org/" ] }, { "id": "remi", "name": "Remi repository (EL)", "group": "Linux packages", "sapis": [ "fpm-fcgi", "apache2handler", "cli", "cgi-fcgi" ], "detect": { "paths": [ "/etc/yum.repos.d/remi*.repo" ] }, "steps": [ { "title": "Check whether Remi has published the fixed build", "commands": [ "sudo dnf --disablerepo='*' --enablerepo='remi*' check-update 'php*'" ] }, { "title": "Update once the fixed build is available", "commands": [ "sudo dnf module reset php -y", "sudo dnf module enable php:remi-{branch} -y", "sudo dnf upgrade --refresh 'php*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo systemctl restart php-fpm" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo systemctl restart httpd" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php -v" ], "notes": [ "Remi's php{branch_nodot} SCL packages (/opt/remi/php{branch_nodot}) are separate; if you run those, sudo dnf upgrade 'php{branch_nodot}*' and restart the matching php{branch_nodot}-php-fpm service.", "Confirm the reported version is {version} or newer before trusting the host." ], "references": [ "https://www.php.net/archive/2026.php", "https://rpms.remirepo.net/", "https://blog.remirepo.net/" ] }, { "id": "amazonlinux-2023", "name": "Amazon Linux 2023", "group": "Linux packages", "sapis": [ "fpm-fcgi", "apache2handler", "cli", "cgi-fcgi" ], "detect": { "osReleaseIds": [ "amzn" ] }, "steps": [ { "title": "Update the versioned PHP {branch} packages", "commands": [ "sudo dnf upgrade --refresh 'php{branch}*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo systemctl restart php-fpm" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo systemctl restart httpd" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php{branch} -v", "php -v" ], "notes": [ "AL2023 backports security fixes into the branch it ships; the reported patch number may differ from php.net's. Confirm against the matching ALAS advisory.", "Pin updates with --releasever if you manage AL2023 to a fixed snapshot." ], "references": [ "https://docs.aws.amazon.com/linux/al2023/ug/package-management.html", "https://alas.aws.amazon.com/alas2023.html" ] }, { "id": "alpine", "name": "Alpine Linux", "group": "Linux packages", "sapis": [ "fpm-fcgi", "apache2handler", "cli", "cgi-fcgi" ], "detect": { "osReleaseIds": [ "alpine" ] }, "steps": [ { "title": "Refresh the package index", "commands": [ "sudo apk update" ] }, { "title": "Upgrade the PHP {branch} packages", "commands": [ "sudo apk upgrade php{branch_nodot} php{branch_nodot}-fpm" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo rc-service php-fpm{branch_nodot} restart" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo rc-service apache2 restart" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php{branch_nodot} -v" ], "notes": [ "Alpine's php{branch_nodot} build backports security fixes into the branch; confirm the reported version against pkgs.alpinelinux.org for your Alpine release.", "A given Alpine release carries one PHP branch in its repositories; a different branch means a different Alpine release or edge." ], "references": [ "https://www.php.net/manual/en/install.unix.alpine.php", "https://pkgs.alpinelinux.org/packages?name=php{branch_nodot}" ] }, { "id": "docker-official", "name": "Official php Docker images", "group": "Containers", "sapis": [ "fpm-fcgi", "apache2handler", "cli" ], "detect": { "paths": [ "/.dockerenv" ] }, "steps": [ { "title": "Pin a patched tag in your Dockerfile or compose file", "commands": [ "FROM php:{version}-fpm", "FROM php:{version}-apache", "FROM php:{version}-cli" ] }, { "title": "Pull the rebuilt images", "commands": [ "docker pull php:{version}-fpm", "docker pull php:{version}-apache", "docker pull php:{version}-cli" ] }, { "title": "Rebuild and recreate your containers", "commands": [ "docker compose build --pull", "docker compose up -d --force-recreate" ] } ], "restart": [ { "sapis": null, "commands": [ "docker compose up -d --force-recreate" ] } ], "verify": [ "docker run --rm php:{version}-cli php -v", "docker compose exec app php -v" ], "notes": [ "The official php images are built from php.net source, so the tag version equals the PHP version ({version}).", "Replace app with your service name. Rebuild derived application images FROM the new base, not only the base image." ], "references": [ "https://hub.docker.com/_/php", "https://github.com/docker-library/php" ] }, { "id": "frankenphp", "name": "FrankenPHP", "group": "Containers", "sapis": [ "frankenphp", "cli" ], "detect": { "commands": [ "frankenphp version" ] }, "steps": [ { "title": "Upgrade the FrankenPHP image (it bundles its own PHP)", "commands": [ "docker pull dunglas/frankenphp:latest-php{branch}", "docker compose build --pull", "docker compose up -d --force-recreate" ] }, { "title": "Or rebuild the static binary", "commands": [ "docker buildx bake --load static-builder", "docker cp $(docker create --name frankenphp-tmp dunglas/frankenphp-static-builder):/go/src/app/dist/frankenphp-linux-$(uname -m) frankenphp" ] } ], "restart": [ { "sapis": [ "frankenphp" ], "commands": [ "docker compose up -d --force-recreate" ] } ], "verify": [ "./frankenphp version", "docker compose exec app php -v" ], "notes": [ "Use a current stable FrankenPHP release and confirm the embedded PHP reports {version} or newer." ], "references": [ "https://frankenphp.dev/docs/", "https://github.com/php/frankenphp/releases", "https://hub.docker.com/r/dunglas/frankenphp" ] }, { "id": "cpanel-ea4", "name": "cPanel / WHM (EasyApache 4)", "group": "Control panels", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "cli" ], "detect": { "paths": [ "/usr/local/cpanel" ] }, "steps": [ { "title": "Update cPanel, then the EasyApache 4 PHP RPMs", "commands": [ "sudo /usr/local/cpanel/scripts/upcp", "sudo yum update 'ea-php{branch_nodot}-*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo /usr/local/cpanel/scripts/restartsrv_apache_php_fpm" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo /usr/local/cpanel/scripts/restartsrv_httpd" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "/opt/cpanel/ea-php{branch_nodot}/root/usr/bin/php -v" ], "notes": [ "Confirm each account's branch in WHM, MultiPHP Manager; upgrade every ea-php branch in use, not only the default.", "Confirm the reported version is {version} or newer. cPanel may ship its build a little after php.net." ], "references": [ "https://docs.cpanel.net/ea4/", "https://docs.cpanel.net/whm/software/easyapache-4/" ] }, { "id": "plesk", "name": "Plesk", "group": "Control panels", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "cli" ], "detect": { "paths": [ "/usr/local/psa", "/opt/plesk" ] }, "steps": [ { "title": "Update Plesk's PHP {branch} packages", "commands": [ "sudo plesk installer update", "sudo apt-get install --only-upgrade 'plesk-php{branch_nodot}*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo systemctl restart plesk-php{branch_nodot}-fpm" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo systemctl restart apache2 || sudo systemctl restart httpd" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "/opt/plesk/php/{branch}/bin/php -v" ], "notes": [ "Upgrade every Plesk PHP branch that domains use, then confirm handlers in Tools & Settings, PHP Settings.", "Confirm the reported version is {version} or newer." ], "references": [ "https://docs.plesk.com/en-US/obsidian/administrator-guide/php-support.59236/", "https://support.plesk.com/hc/en-us/articles/12377435963927" ] }, { "id": "cloudlinux-altphp", "name": "CloudLinux alt-php (PHP Selector)", "group": "Control panels", "sapis": [ "fpm-fcgi", "litespeed", "cgi-fcgi", "cli" ], "detect": { "osReleaseIds": [ "cloudlinux" ], "paths": [ "/opt/alt" ] }, "steps": [ { "title": "Update the alt-php {branch} packages", "commands": [ "sudo yum update 'alt-php{branch_nodot}*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi", "litespeed", "cgi-fcgi" ], "commands": [ "sudo systemctl restart httpd || sudo systemctl restart lsws" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "/opt/alt/php{branch_nodot}/usr/bin/php -v" ], "notes": [ "Users pick their branch in the PHP Selector; upgrade every alt-php branch in use, not only the default.", "Confirm the reported version is {version} or newer. If an update stalls on a dependency conflict, exclude the offending package (for example dnf update --exclude=alt-php-internal*) and retry." ], "references": [ "https://docs.cloudlinux.com/shared/php_selector/", "https://docs.cloudlinux.com/shared/cloudlinux_os_components/#php-selector" ] }, { "id": "directadmin", "name": "DirectAdmin (CustomBuild)", "group": "Control panels", "sapis": [ "fpm-fcgi", "cgi-fcgi", "cli" ], "detect": { "paths": [ "/usr/local/directadmin" ] }, "steps": [ { "title": "Update CustomBuild and rebuild the PHP {branch} slot", "commands": [ "cd /usr/local/directadmin/custombuild", "sudo ./build update", "sudo ./build php_expert {branch} php-fpm", "sudo ./build rewrite_confs" ] } ], "restart": [ { "sapis": [ "fpm-fcgi", "cgi-fcgi" ], "commands": [ "sudo systemctl restart php-fpm{branch_nodot}" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "/usr/local/php{branch_nodot}/bin/php -v" ], "notes": [ "DirectAdmin supports up to four PHP slots (php1_release to php4_release); rebuild every slot that serves a domain.", "CustomBuild compiles from php.net source, so the reported version should be exactly {version} once the tarball it fetches is current; run ./build update first." ], "references": [ "https://docs.directadmin.com/webservices/php/", "https://docs.directadmin.com/webservices/php/choosing-version.html" ] }, { "id": "litespeed-lsphp", "name": "LiteSpeed / OpenLiteSpeed (lsphp)", "group": "Control panels", "sapis": [ "litespeed", "cli" ], "detect": { "paths": [ "/usr/local/lsws" ] }, "steps": [ { "title": "Upgrade the lsphp {branch} packages", "commands": [ "sudo apt-get update", "sudo apt-get install --only-upgrade 'lsphp{branch_nodot}*'" ] } ], "restart": [ { "sapis": [ "litespeed" ], "commands": [ "sudo /usr/local/lsws/bin/lswsctrl restart" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "/usr/local/lsws/lsphp{branch_nodot}/bin/php -v" ], "notes": [ "Point each virtual host's lsphp path at the upgraded branch if you are also moving branch.", "Confirm the reported version is {version} or newer." ], "references": [ "https://docs.openlitespeed.org/config/php/", "https://www.php.net/manual/en/install.unix.litespeed.php" ] }, { "id": "forge", "name": "Laravel Forge", "group": "Managed provisioners", "sapis": [ "fpm-fcgi", "cli" ], "steps": [ { "title": "Patch PHP from the Forge dashboard", "commands": [], "note": "Server, PHP, Patch Security Releases (or Update PHP) installs the fixed build and restarts FPM for you." }, { "title": "CLI fallback (Forge servers are Ubuntu)", "commands": [ "sudo apt-get update", "sudo apt-get install --only-upgrade 'php{branch}*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo service php{branch}-fpm restart", "sudo service nginx reload" ] }, { "sapis": [ "cli" ], "commands": [ "php artisan queue:restart" ] } ], "verify": [ "php{branch} -v", "php -v" ], "notes": [ "php on a Forge server points at the CLI default version; use php{branch} to target a specific branch.", "Confirm the reported version is {version} or newer." ], "references": [ "https://forge.laravel.com/docs/servers/php", "https://www.php.net/archive/2026.php" ] }, { "id": "ploi", "name": "Ploi", "group": "Managed provisioners", "sapis": [ "fpm-fcgi", "cli" ], "steps": [ { "title": "Patch PHP from the Ploi dashboard", "commands": [], "note": "Server, PHP, update the installed version so Ploi's recorded PHP version matches what runs." }, { "title": "CLI fallback (Ploi servers are Ubuntu)", "commands": [ "sudo apt-get update", "sudo apt-get install --only-upgrade 'php{branch}*'" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo service php{branch}-fpm restart", "sudo service nginx reload" ] }, { "sapis": [ "cli" ], "commands": [ "php artisan queue:restart" ] } ], "verify": [ "php{branch} -v", "php -v" ], "notes": [ "Confirm the reported version is {version} or newer.", "Prefer the dashboard so Ploi's recorded PHP version matches what is installed." ], "references": [ "https://ploi.io/documentation", "https://www.php.net/archive/2026.php" ] }, { "id": "runcloud", "name": "RunCloud", "group": "Managed provisioners", "sapis": [ "fpm-fcgi", "cli" ], "steps": [ { "title": "Patch PHP from the RunCloud panel", "commands": [], "note": "Web Application, Settings, PHP version: RunCloud installs its own versioned packages and restarts the matching FPM pool." } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [], "note": "RunCloud restarts its FPM service when you change or update the version from the panel; verify on the server afterwards." }, { "sapis": [ "cli" ], "commands": [ "php artisan queue:restart" ] } ], "verify": [ "php -v" ], "notes": [ "We could not confirm a public CLI upgrade command or the exact FPM service names from RunCloud's documentation, so this entry leads with the panel; verify the restart on your server.", "Confirm the reported version is {version} or newer after updating." ], "references": [ "https://runcloud.io/docs", "https://www.php.net/archive/2026.php" ] }, { "id": "herd-valet", "name": "Laravel Herd / Valet (macOS)", "group": "Local development", "sapis": [ "cli", "fpm-fcgi" ], "detect": { "paths": [ "~/Library/Application Support/Herd", "~/.config/valet" ] }, "steps": [ { "title": "Herd: update PHP from the app", "commands": [ "herd php:update" ] }, { "title": "Valet: update the Homebrew PHP it uses", "commands": [ "brew update", "brew upgrade php", "valet restart" ] } ], "restart": [ { "sapis": null, "commands": [ "herd restart" ] } ], "verify": [ "herd php -v", "php -v" ], "notes": [ "These are local development tools; a developer laptop is lower risk than a server, but upgrade so you are not building against a vulnerable runtime.", "Confirm the reported version is {version} or newer." ], "references": [ "https://herd.laravel.com/docs/macos/technology/php-versions", "https://laravel.com/docs/valet" ] }, { "id": "homebrew", "name": "Homebrew (macOS)", "group": "Local development", "sapis": [ "cli", "fpm-fcgi", "apache2handler" ], "detect": { "paths": [ "/opt/homebrew/bin/brew", "/usr/local/bin/brew" ] }, "steps": [ { "title": "Update and upgrade the PHP formula", "commands": [ "brew update", "brew upgrade php@{branch}", "brew link --overwrite --force php@{branch}" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "brew services restart php@{branch}" ] }, { "sapis": [ "apache2handler" ], "commands": [ "brew services restart httpd" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php -v", "php@{branch} -v || true" ], "notes": [ "brew services restart only applies if the web server runs as a Homebrew service.", "Confirm the reported version is {version} or newer in a fresh terminal." ], "references": [ "https://formulae.brew.sh/formula/php", "https://github.com/shivammathur/homebrew-php" ] }, { "id": "windows", "name": "Windows (windows.php.net builds)", "group": "Other", "sapis": [ "cgi-fcgi", "apache2handler", "cli" ], "steps": [ { "title": "Download the fixed {branch} build", "commands": [], "note": "Get the {version} zip from windows.php.net/download (NTS for IIS/FastCGI, TS for Apache mod_php) and verify its checksum." }, { "title": "Stop the web server", "commands": [ "iisreset /stop" ] }, { "title": "Replace the files", "commands": [], "note": "Unzip over the existing PHP directory, keeping your php.ini." }, { "title": "Start the web server", "commands": [ "iisreset /start" ] } ], "restart": [ { "sapis": [ "cgi-fcgi" ], "commands": [ "iisreset" ] }, { "sapis": [ "apache2handler" ], "commands": [ "net stop Apache2.4", "net start Apache2.4" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php -v" ], "notes": [ "Do not expose php-cgi.exe through Apache ScriptAlias/Action: CVE-2024-4577 is an actively exploited php-cgi argument-injection bug on Windows. Use mod_php, PHP-FPM, or FastCGI with a fixed handler.", "Confirm the reported version is {version} or newer." ], "references": [ "https://windows.php.net/download/", "https://www.php.net/downloads.php?os=windows" ] }, { "id": "source", "name": "Build from source", "group": "Other", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "cli" ], "steps": [ { "title": "Fetch and unpack the fixed release", "commands": [ "curl -fsSLO https://www.php.net/distributions/php-{version}.tar.gz", "curl -fsSLO https://www.php.net/distributions/php-{version}.tar.gz.asc", "tar -xf php-{version}.tar.gz", "cd php-{version}" ] }, { "title": "Configure, compile and install", "commands": [ "./configure $(php-config --configure-options)", "make -j\"$(nproc)\"", "sudo make install" ] } ], "restart": [ { "sapis": [ "fpm-fcgi" ], "commands": [ "sudo systemctl restart php-fpm" ] }, { "sapis": [ "apache2handler", "cgi-fcgi" ], "commands": [ "sudo systemctl restart apache2 || sudo systemctl restart httpd" ] }, { "sapis": [ "cli" ], "commands": [] } ], "verify": [ "php -v", "php-fpm -v" ], "notes": [ "Because you build the official source, the reported version is exactly {version}.", "Rebuild and reinstall for every branch and SAPI you run from source." ], "references": [ "https://www.php.net/manual/en/install.unix.php", "https://www.php.net/downloads.php" ] } ], "mitigations": [ { "id": "memory-limit", "title": "Remove the memory limit (make OOM less reachable)", "where": "FPM pool (/etc/php/{branch}/fpm/pool.d/www.conf) or Apache vhost", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp" ], "snippets": { "default": "; PHP-FPM pool\nphp_admin_value[memory_limit] = -1", "apache2handler": "# Apache vhost (mod_php)\nphp_admin_value memory_limit -1", "cgi-fcgi": "; php.ini used by php-cgi\nmemory_limit = -1", "litespeed": "; lsphp php.ini\nmemory_limit = -1", "frankenphp": "; php.ini loaded by FrankenPHP\nmemory_limit = -1" }, "notes": [ "The primary configuration mitigation, and not a complete one. Set it so applications cannot override it and restart every worker.", "With no limit a single request can use all memory; watch memory and put a sane limit back once you have patched." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "https://www.php.net/archive/2026.php" ] }, { "id": "post-max-size", "title": "Keep request bodies small", "where": "FPM pool or php.ini", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp" ], "snippets": { "default": "php_admin_value[post_max_size] = 8M\nphp_admin_value[upload_max_filesize] = 2M", "apache2handler": "php_admin_value post_max_size 8M\nphp_admin_value upload_max_filesize 2M", "cgi-fcgi": "post_max_size = 8M\nupload_max_filesize = 2M", "litespeed": "post_max_size = 8M\nupload_max_filesize = 2M", "frankenphp": "post_max_size = 8M\nupload_max_filesize = 2M" }, "notes": [ "Keep it conservative: 8M without uploads, 32M if uploads are needed. Keep upload_max_filesize below post_max_size." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "https://www.php.net/archive/2026.php" ] }, { "id": "nesting", "title": "Reduce input nesting", "where": "FPM pool or php.ini", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp" ], "snippets": { "default": "php_admin_value[max_input_nesting_level] = 16", "apache2handler": "php_admin_value max_input_nesting_level 16", "cgi-fcgi": "max_input_nesting_level = 16", "litespeed": "max_input_nesting_level = 16", "frankenphp": "max_input_nesting_level = 16" }, "notes": [ "The advisory recommends reducing it below the default of 64, and bounding input variables, multipart parts, headers per part and uploads." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" ] }, { "id": "upload-progress", "title": "Disable session upload progress", "where": "php.ini, FPM pool, or server config applied before request parsing", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp" ], "snippets": { "default": "php_admin_flag[session.upload_progress.enabled] = off", "apache2handler": "php_admin_flag session.upload_progress.enabled off", "cgi-fcgi": "session.upload_progress.enabled = 0", "litespeed": "session.upload_progress.enabled = 0", "frankenphp": "session.upload_progress.enabled = 0" }, "notes": [ "Set it where it applies before request parsing, then restart every worker. Do not rely on ini_set() or .user.ini.", "This blocks the confirmed session paths, not every variant. Keep it off after patching if you do not use the feature." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "backtraces", "title": "Disable fatal error backtraces (PHP 8.5 only)", "where": "php.ini or FPM pool", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp" ], "snippets": { "default": "php_admin_value[fatal_error_backtraces] = 0", "apache2handler": "php_admin_value fatal_error_backtraces 0", "cgi-fcgi": "fatal_error_backtraces = 0", "litespeed": "fatal_error_backtraces = 0", "frankenphp": "fatal_error_backtraces = 0" }, "notes": [ "PHP 8.5 only. Removes the producer used by the confirmed RCE case. Restart every worker." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "per-request-ini", "title": "Remove per-request INI that emits startup diagnostics", "where": ".user.ini, .htaccess php_value, FPM pool php_value, PHP_VALUE/PHP_ADMIN_VALUE", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp" ], "snippets": { "default": "; Remove or fix settings that emit a diagnostic before request startup:\n; auto_detect_line_endings = 1\n; report_memleaks = 0 (8.5)\n; legacy assert.* settings (8.3+)\n; legacy session settings (8.4+)\n; invalid memory_limit or date.timezone values" }, "notes": [ "These are the pre-startup diagnostic triggers behind CVE-2026-109619. Turning off error_reporting or display_errors, or using @, does not help.", "Verify the exact deprecated names against php.net's migration and deprecation notes for your branch." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "id": "webserver-limits", "title": "Enforce request limits at the web server / proxy", "where": "nginx / Apache / proxy configuration", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp" ], "snippets": { "default": "# nginx example\nclient_max_body_size 8m;\nclient_body_buffer_size 16k;\nlarge_client_header_buffers 4 8k;", "apache2handler": "# Apache example\nLimitRequestBody 8388608\nLimitRequestFields 100\nLimitRequestFieldSize 8190" }, "notes": [ "Bound decoded request size, input field count, multipart part count, header count and nesting depth, including requests with no usable Content-Length.", "If the application does not use multipart/form-data, block it at the front end." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" ] }, { "id": "rlimit", "title": "Do NOT use RLIMIT_AS / RLIMIT_DATA as a substitute", "where": "systemd unit, ulimit, container limits", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp", "cli" ], "snippets": { "default": "# Avoid: LimitAS / ulimit -v as a mitigation\n# A container or cgroup memory.max is an availability boundary only." }, "notes": [ "RLIMIT_AS / RLIMIT_DATA make mmap() fail, which triggers the vulnerable longjmp() path.", "A container or cgroup memory.max limit bounds availability; it does not stop the bug." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" ] }, { "id": "error-logging", "title": "Turn on error logging to find reachable fatals", "where": "startup php.ini (not per-request)", "sapis": [ "fpm-fcgi", "apache2handler", "cgi-fcgi", "litespeed", "frankenphp" ], "snippets": { "default": "log_errors = On\nerror_reporting = E_ALL\nerror_log = /var/log/php/error.log" }, "notes": [ "Set these in startup configuration to surface warnings and fatal errors an attacker could reach in callbacks, uploads, imports and cleanup. An empty log is not proof of safety.", "Consider pm.max_requests = 1 if you can afford the performance cost." ], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] } ], "after_patch": [ { "id": "restart", "title": "Restart every PHP worker and web server", "body": "The patched binary only loads in fresh processes. PHP-FPM pools, Apache mod_php, LiteSpeed lsphp, FrankenPHP workers, php-cgi processes and queue workers (Horizon, Supervisor, long-lived cron children) that started before the upgrade still run the old, vulnerable code. Restart them all and confirm start times are newer than the upgraded binary.", "commands": [ "sudo systemctl restart php{branch}-fpm || sudo systemctl restart php-fpm", "sudo systemctl restart apache2 || sudo systemctl restart httpd", "php artisan queue:restart" ], "references": [ "https://www.php.net/archive/2026.php" ] }, { "id": "rotate", "title": "Rotate secrets that may have leaked", "body": "CVE-2026-109619 includes an unauthenticated memory-disclosure path. On any host that was internet-facing before you patched, treat secrets readable by the web worker as potentially exposed and rotate them: database passwords, APP_KEY / app secrets, third-party API keys, OAuth client secrets, mail credentials, and any crypto or Solana private keys, seed phrases or mnemonics in the environment or on disk. Revoke the old values, do not just add new ones.", "commands": [], "references": [ "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp", "https://www.php.net/archive/2026.php" ] }, { "id": "scan", "title": "Scan for signs of compromise", "body": "Both CVEs were exploited in the wild before the patch shipped, so patching does not undo a prior break-in. Run a full scan for webshells, modified framework and core files, PHP inside upload directories and exposed keys, and review web server access and error logs around the exposure window for anomalies.", "commands": [ "phpshield scan --since 2026-10-20", "phpshield scan /var/www --skip runtime --format md -o compromise-report.md" ], "references": [ "https://www.php.net/archive/2026.php" ] }, { "id": "undo", "title": "Undo interim mitigations you no longer need", "body": "Once every worker runs the patched build, restore memory_limit, post_max_size and max_input_nesting_level to normal values so the host is not left fragile. Keep session.upload_progress off and (on 8.5) fatal_error_backtraces off if you do not use them.", "commands": [], "references": [ "https://www.php.net/archive/2026.php" ] }, { "id": "confirm", "title": "Confirm the fixed version is live on every SAPI", "body": "Check the CLI, every FPM pool and the web-facing runtime. The version a browser sees can differ from the CLI. Confirm each reports the branch's fixed release or newer.", "commands": [ "php -v", "php{branch} -v", "curl -sI https://your-site.example/ | grep -i x-powered-by" ], "references": [ "https://www.php.net/archive/2026.php" ] } ] }PK+iX]PJ^%%phpshield/data.py"""Bundled data (advisories, branches, platforms, rules, releases) and the local cache.""" import json import os import pkgutil from functools import lru_cache CACHE_DIR = os.path.join(os.path.expanduser("~"), ".cache", "phpshield") def _read(name): # pkgutil works both from a checkout and from inside the zipapp raw = pkgutil.get_data(__package__ or "phpshield", "data/" + name) if raw is None: raise FileNotFoundError(name) return raw.decode("utf-8") def _load(name): return json.loads(_read(name)) @lru_cache(maxsize=None) def advisories(): return _load("advisories.json")["advisories"] @lru_cache(maxsize=None) def branches(): return _load("branches.json")["branches"] @lru_cache(maxsize=None) def platforms(): return _load("platforms.json") @lru_cache(maxsize=None) def ini_rules(): return _load("ini-rules.json")["rules"] @lru_cache(maxsize=None) def code_rules(): return _load("code-rules.json")["rules"] @lru_cache(maxsize=None) def crypto_rules(): return _load("crypto-rules.json")["rules"] @lru_cache(maxsize=None) def bip39(): return set(w.strip() for w in _read("bip39-english.txt").splitlines() if w.strip()) @lru_cache(maxsize=None) def releases(): """The php.net release data, preferring a cache written by `phpshield update`.""" cached = os.path.join(CACHE_DIR, "php-releases.json") if os.path.exists(cached): try: with open(cached, "r", encoding="utf-8") as fh: data = json.load(fh) if data.get("releases"): data["_from"] = cached return data except Exception: pass data = _load("php-releases.json") data["_from"] = "bundled" return data def data_generated_at(): return releases().get("generatedAt", "") PK+iX]000phpshield/fix.py"""Fix playbooks: platform × SAPI × branch, rendered as text, markdown or a reviewable shell script.""" from . import data from .versions import supported_branches def fill(s, branch, version): return s.replace("{branch_nodot}", branch.replace(".", "")).replace("{branch}", branch).replace("{version}", version) def target_version(branch): php2shell = [a for a in data.advisories() if a["name"] == "PHP2Shell"][0] return php2shell["fixed"].get(branch) or data.releases()["branches"].get(branch, {}).get("latest") or branch + ".0" def platform_by_id(pid): for p in data.platforms()["platforms"]: if p["id"] == pid: return p return None def _lines(platform_id, branch, sapi, detected): """Structured playbook: a list of (kind, text) with kind in h1, h2, text, note, cmd.""" pd = data.platforms() p = platform_by_id(platform_id) if p is None: raise ValueError("unknown platform %r; one of: %s" % (platform_id, ", ".join(x["id"] for x in pd["platforms"]))) if sapi not in p["sapis"]: sapi = p["sapis"][0] version = target_version(branch) f = lambda s: fill(s, branch, version) labels = pd["sapi_labels"] out = [("h1", "phpshield fix: %s" % p["name"])] if detected: out.append(("note", "(auto-detected platform/branch/SAPI on this host; override with --platform/--branch/--sapi)")) out.append(("text", "Target: PHP %s · %s · %s" % (version, p["name"], labels[sapi]))) out.append(("h2", "Upgrade")) for i, step in enumerate(p["steps"], 1): out.append(("text", "%d. %s" % (i, f(step["title"])))) for c in step.get("commands", []): out.append(("cmd", f(c))) if step.get("note"): out.append(("note", f(step["note"]))) out.append(("h2", "Restart")) for r in p["restart"]: if r.get("sapis") is not None and sapi not in r["sapis"]: continue for c in r.get("commands", []): out.append(("cmd", f(c))) if r.get("note"): out.append(("note", f(r["note"]))) out.append(("h2", "Verify")) for c in p["verify"]: out.append(("cmd", f(c))) out.append(("note", "The version a browser sees can differ from the CLI; confirm every SAPI reports %s or newer." % version)) for n in p.get("notes", []): out.append(("note", f(n))) out.append(("h2", "Interim mitigations")) out.append(("note", pd["mitigations_intro"])) for m in pd["mitigations"]: if sapi not in m["sapis"]: continue out.append(("text", "* " + m["title"])) snippet = m["snippets"].get(sapi) or m["snippets"]["default"] for line in f(snippet).splitlines(): out.append(("snippet", line)) out.append(("h2", "After the patch")) for a in pd["after_patch"]: out.append(("text", "* " + a["title"])) for c in a.get("commands", []): out.append(("cmd", f(c))) out.append(("note", "Sources: " + " · ".join(f(r) for r in p.get("references", [])))) return out, version, p, labels[sapi] def render(platform_id, branch, sapi, fmt="text", detected=False): lines, version, p, sapi_label = _lines(platform_id, branch, sapi, detected) out = [] if fmt == "sh": out += ["#!/bin/sh", "# phpshield fix: %s / %s / PHP %s. Review every line before running." % (p["name"], sapi_label, version), "set -eu", ""] for kind, text in lines: if fmt == "sh": if kind == "cmd": out.append(text) elif kind == "snippet": out.append("# " + text) elif kind in ("h1", "h2"): out += ["", "# == %s ==" % text] else: out.append("# " + text) elif fmt == "md": if kind == "h1": out.append("# " + text) elif kind == "h2": out += ["", "## " + text, ""] elif kind == "cmd": out.append(" $ " + text) elif kind == "snippet": out.append(" " + text) elif kind == "note": out.append("> " + text) else: out.append(text) else: if kind == "h1": out.append(text) elif kind == "h2": out += ["", "== %s ==" % text] elif kind == "cmd": out.append(" $ " + text) elif kind == "snippet": out.append(" " + text) elif kind == "note": out.append(" " + text) else: out.append(text) return "\n".join(out) def active_support_line(): active, security = supported_branches() rel = data.releases()["branches"] return " ".join("%s -> %s" % (b, rel.get(b, {}).get("latest", "?")) for b in (active or security[:2])) PK+iX]H1MMphpshield/ini.py"""php.ini / FPM pool / phpinfo audit, mirroring lib/ini.ts.""" import re from . import data from .model import Finding FALSY = set(["", "0", "off", "no", "false", "none"]) def truthy(v): return v.strip().lower() not in FALSY def to_bytes(v): m = re.match(r"^(-?\d+)\s*([kmg])?b?$", v.strip(), re.I) if not m: return None n, u = int(m.group(1)), (m.group(2) or "").lower() return n * {"k": 1024, "m": 1024 ** 2, "g": 1024 ** 3}.get(u, 1) def _strip(v): t = re.sub(r"\s*;.*$", "", v.strip()) return re.sub(r"^\"(.*)\"$|^'(.*)'$", lambda m: m.group(1) if m.group(1) is not None else m.group(2), t).strip() def _decode(s): return s.replace(" ", " ").replace("<", "<").replace(">", ">").replace(""", '"').replace("'", "'").replace("&", "&") def parse_ini(text): out = {} if re.search(r"]*>([\s\S]*?)", text, re.I): cells = [_decode(re.sub(r"<[^>]+>", "", c)).strip() for c in re.findall(r"]*>([\s\S]*?)", row.group(1), re.I)] if len(cells) >= 2 and re.match(r"^[\w.]+$", cells[0]): out[cells[0].lower()] = "" if cells[1] == "no value" else cells[1] if out: return out for raw in text.splitlines(): line = raw.strip() if not line or line[0] in ";#[": continue m = re.match(r"^([\w.]+)\s*=>\s*(.*?)(?:\s*=>\s*(.*))?$", line) if m: v = m.group(2).strip() out[m.group(1).lower()] = "" if v == "no value" else v continue m = re.match(r"^php_(?:admin_)?(?:value|flag)\[([\w.]+)\]\s*=\s*(.*)$", line, re.I) or re.match(r"^php_(?:admin_)?(?:value|flag)\s+([\w.]+)\s+(.*)$", line, re.I) or re.match(r"^([\w.]+)\s*=\s*(.*)$", line) if m: out[m.group(1).lower()] = _strip(m.group(2)) return out def _test(rule, cfg): key = rule["key"].lower() present = key in cfg v = cfg.get(key) operand = rule.get("value") or "" if operand.startswith("@"): other = cfg.get(operand[1:].lower()) if other is None: return False operand = other op = rule["op"] if op == "present": return present if op == "missing": return not present if not present: return False if op == "empty": return v.strip() == "" if op == "not_empty": return v.strip() != "" if op == "truthy": return truthy(v) if op == "falsy": return not truthy(v) if op == "equals": return v.strip().lower() == operand.lower() if op == "not_equals": return v.strip().lower() != operand.lower() if op == "contains": return operand.lower() in v.lower() if op in ("bytes_gt", "bytes_lt"): a, b = to_bytes(v), to_bytes(operand) if a is None or b is None: return False return a > b if op == "bytes_gt" else a < b if op == "regex": return re.search(operand, v, re.I) is not None return False def audit_text(text, location): cfg = parse_ini(text) findings = [] for r in data.ini_rules(): if _test(r, cfg): found = cfg.get(r["key"].lower()) findings.append(Finding(r["id"], r["severity"], "config", r["title"], location, None, "%s = %s" % (r["key"], found if found not in (None, "") else "(not set)"), r["fix"], r["references"], extra={"expected": r["expected"], "why": r["why"], "group": r["group"]})) return findings, len(cfg) PK+iX]ѕ^phpshield/model.py"""Findings and severities, shared by every check and report.""" import hashlib SEVERITIES = ["info", "low", "medium", "high", "critical"] CATEGORIES = { "runtime": "PHP runtime", "config": "Configuration", "dependency": "Dependencies", "code": "Application code", "compromise": "Indicators of compromise", "crypto": "Exposed keys & wallets", "integrity": "File integrity", } def sev_index(s): return SEVERITIES.index(s) if s in SEVERITIES else -1 class Finding(object): def __init__(self, id, severity, category, title, location, line=None, evidence=None, fix="", references=None, confidence="high", extra=None): self.id = id self.severity = severity self.category = category self.title = title self.location = location self.line = line self.evidence = evidence self.fix = fix self.references = references or [] self.confidence = confidence self.extra = extra or {} @property def fingerprint(self): key = "|".join([self.id, self.location, str(self.line or ""), (self.evidence or "")[:80]]) return hashlib.sha256(key.encode("utf-8")).hexdigest()[:16] def to_dict(self): d = { "id": self.id, "severity": self.severity, "title": self.title, "category": self.category, "location": self.location, "line": self.line, "evidence": self.evidence, "fix": self.fix, "references": self.references, "confidence": self.confidence, "fingerprint": self.fingerprint, } d.update(self.extra) return d def sort_findings(findings): return sorted(findings, key=lambda f: (-sev_index(f.severity), f.location, f.line or 0)) def mask(value): v = value.strip() if len(v) <= 10: return "•" * len(v) return v[:4] + "•" * min(24, len(v) - 8) + v[-4:] PK+iX]fQ\\phpshield/monitor.py"""Re-scan on an interval, diff by fingerprint, post the delta to a webhook.""" import datetime import json import os import time from . import data, net, scan from .model import SEVERITIES, sev_index, sort_findings def parse_duration(s): s = str(s).strip().lower() m = {"s": 1, "m": 60, "h": 3600, "d": 86400} if s[-1] in m: return int(float(s[:-1]) * m[s[-1]]) return int(s) def load_state(path): try: with open(path, "r", encoding="utf-8") as fh: return json.load(fh) except Exception: return None def save_state(path, state): os.makedirs(os.path.dirname(path) or ".", exist_ok=True) with open(path, "w", encoding="utf-8") as fh: json.dump(state, fh, indent=1) def post_webhook(url, fmt, payload_json, text): if not url: return "no webhook" if fmt == "slack": body = {"text": text} elif fmt == "discord": body = {"content": text[:1900]} else: body = payload_json net.post_json(url, body) return "delivered (%s)" % fmt def cycle(paths, opts, state_path, webhook, webhook_fmt, log): prev = load_state(state_path) or {} findings, errors, _ = scan.run(paths, opts, log) findings = sort_findings(findings) now = {f.fingerprint: f.to_dict() for f in findings} old = prev.get("findings") or {} new_fps = [fp for fp in now if fp not in old] resolved = [old[fp] for fp in old if fp not in now] seen_releases = set(prev.get("security_releases") or []) cur_releases = set() for b in data.releases().get("branches", {}).values(): cur_releases.update(b.get("security", [])) new_releases = sorted(cur_releases - seen_releases) if seen_releases else [] stamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S") lines = ["[%s] phpshield monitor: %d finding(s): %d new, %d resolved" % (stamp, len(now), len(new_fps), len(resolved))] if new_fps: lines.append(" NEW:") for fp in new_fps[:40]: f = now[fp] lines.append(" * [%s] %s: %s (%s%s)" % (f["severity"].upper(), f["id"], f["title"], f["location"], (":%d" % f["line"]) if f.get("line") else "")) if resolved: lines.append(" RESOLVED:") for f in resolved[:40]: lines.append(" * [%s] %s: %s (%s)" % (f["severity"].upper(), f["id"], f["title"], f["location"])) if new_releases: lines.append(" NEW PHP SECURITY RELEASES: " + ", ".join(new_releases)) if not new_fps and not resolved and not new_releases: lines.append(" no change since last run") text = "\n".join(lines) changed = bool(new_fps or resolved or new_releases) delivered = None if changed and prev: try: delivered = post_webhook(webhook, webhook_fmt, {"tool": "phpshield", "new": [now[fp] for fp in new_fps], "resolved": resolved, "new_security_releases": new_releases}, text) except Exception as e: delivered = "failed: %s" % e save_state(state_path, {"updated": stamp, "findings": now, "security_releases": sorted(cur_releases)}) worst = max([sev_index(now[fp]["severity"]) for fp in new_fps] or [-1]) return text + ("\n webhook: %s" % delivered if delivered else ""), worst, errors def run(paths, opts, interval, once, state_path, webhook, webhook_fmt, fail_on, log): while True: text, worst, errors = cycle(paths, opts, state_path, webhook, webhook_fmt, log) print(text) for e in errors: print("error: " + e) code = 0 if fail_on != "never" and worst >= 0 and worst >= SEVERITIES.index(fail_on): code = 1 if once: return code print("phpshield monitor: next cycle in %ds (Ctrl-C to stop)" % interval) try: time.sleep(interval) except KeyboardInterrupt: print("phpshield monitor: stopped") return 0 PK+iX]Qphpshield/net.py"""Every network request the tool makes goes through this module. --offline turns it all off.""" import json import urllib.parse import urllib.request OFFLINE = False USER_AGENT = "phpshield/1.0 (+https://phpshield.live)" class Offline(Exception): pass def get_json(url, timeout=20): if OFFLINE: raise Offline("offline: " + host_of(url)) req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT, "Accept": "application/json"}) with urllib.request.urlopen(req, timeout=timeout) as res: return json.loads(res.read().decode("utf-8")) def post_json(url, body, timeout=20, headers=None): if OFFLINE: raise Offline("offline: " + host_of(url)) data = json.dumps(body).encode("utf-8") h = {"User-Agent": USER_AGENT, "Content-Type": "application/json"} h.update(headers or {}) req = urllib.request.Request(url, data=data, headers=h, method="POST") with urllib.request.urlopen(req, timeout=timeout) as res: raw = res.read().decode("utf-8") return json.loads(raw) if raw.strip() else None def host_of(url): try: u = urllib.parse.urlsplit(url) return "%s://%s" % (u.scheme, u.netloc) except Exception: return url PK+iX]]/¢b b phpshield/report.py"""Report rendering: text, json, sarif, html, md.""" import datetime import json import sys from . import __version__, data from .model import CATEGORIES, SEVERITIES, sev_index, sort_findings def _now(): return datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ") def summary(findings, fail_on): by_sev = dict((s, 0) for s in SEVERITIES) by_cat = {} for f in findings: by_sev[f.severity] = by_sev.get(f.severity, 0) + 1 by_cat[f.category] = by_cat.get(f.category, 0) + 1 worst = None for f in findings: if worst is None or sev_index(f.severity) > sev_index(worst): worst = f.severity return {"total": len(findings), "by_severity": by_sev, "by_category": by_cat, "worst": worst, "fail_on": fail_on} def envelope(findings, targets, errors, installs, fail_on): return { "tool": "phpshield", "version": __version__, "generated_at": _now(), "data_generated_at": data.data_generated_at(), "target": targets, "summary": summary(findings, fail_on), "findings": [f.to_dict() for f in sort_findings(findings)], "errors": errors, "installs": installs, } class Paint(object): def __init__(self, enabled): self.enabled = enabled def __call__(self, s, sev): if not self.enabled: return s code = {"critical": "31;1", "high": "31", "medium": "33", "low": "36", "info": "2", "ok": "32"}.get(sev, "0") return "\033[%sm%s\033[0m" % (code, s) def header(env, paint): s = env["summary"] counts = ", ".join("%d %s" % (s["by_severity"][k], k) for k in reversed(SEVERITIES) if s["by_severity"].get(k)) return ["phpshield %s (data: php.net, generated %s)" % (env["version"], env["data_generated_at"]), "scanned: %s" % ", ".join(env["target"]), "findings: %s" % (counts or "none")] def result_line(env, exit_code): fo = env["summary"]["fail_on"] if fo == "never": return "RESULT: nothing at or above never." return "RESULT: %s (exit %d)" % (("findings at or above %s." % fo) if exit_code == 1 else ("nothing at or above %s." % fo), exit_code) def render_text(env, paint, quiet=False, exit_code=0): out = header(env, paint) if not quiet: out.append("") groups = {} for f in env["findings"]: groups.setdefault(f["category"], []).append(f) for cat in ("runtime", "config", "dependency", "code", "compromise", "crypto", "integrity"): fs = groups.get(cat) if not fs: continue out.append("== %s (%d) ==" % (CATEGORIES[cat], len(fs))) for f in fs: out.append("%s %s %s" % (paint("[%s]" % f["severity"].upper(), f["severity"]), f["id"], f["title"])) out.append(" %s%s" % (f["location"], (":%d" % f["line"]) if f.get("line") else "")) if f.get("evidence"): out.append(" evidence: %s" % f["evidence"]) if f.get("address"): out.append(" public address: %s" % f["address"]) out.append(" fix: %s" % f["fix"]) for r in f.get("references", [])[:2]: out.append(" ref: %s" % r) out.append("") for e in env["errors"]: out.append("error: %s" % e) out.append(result_line(env, exit_code)) return "\n".join(out) def render_md(env, exit_code=0): out = ["# phpshield scan", "", "- tool: phpshield %s (data generated %s)" % (env["version"], env["data_generated_at"]), "- scanned: %s" % ", ".join(env["target"]), "- findings: %d" % env["summary"]["total"], ""] groups = {} for f in env["findings"]: groups.setdefault(f["category"], []).append(f) for cat, fs in groups.items(): out.append("## %s (%d)" % (CATEGORIES.get(cat, cat), len(fs))) out.append("") for f in fs: loc = "%s%s" % (f["location"], (":%d" % f["line"]) if f.get("line") else "") out.append("- `%s` **%s** %s (%s)" % (f["severity"].upper(), f["id"], f["title"], loc)) if f.get("evidence"): out.append(" - evidence: `%s`" % f["evidence"].replace("`", "'")) out.append(" - fix: %s" % f["fix"]) out.append("") out.append(result_line(env, exit_code)) return "\n".join(out) def render_sarif(env): rules, seen = [], {} results = [] level = {"critical": "error", "high": "error", "medium": "warning", "low": "note", "info": "note"} for f in env["findings"]: if f["id"] not in seen: seen[f["id"]] = len(rules) rules.append({"id": f["id"], "name": f["id"], "shortDescription": {"text": f["title"]}, "fullDescription": {"text": f["fix"]}, "helpUri": (f.get("references") or ["https://phpshield.live/docs/"])[0], "properties": {"security-severity": {"critical": "9.5", "high": "8.0", "medium": "5.0", "low": "2.0", "info": "0.5"}[f["severity"]]}}) region = {"startLine": f["line"]} if f.get("line") else {} results.append({ "ruleId": f["id"], "ruleIndex": seen[f["id"]], "level": level[f["severity"]], "message": {"text": "%s%s" % (f["title"], (" Evidence: " + f["evidence"]) if f.get("evidence") else "")}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": f["location"]}, "region": region}}] if f.get("location") else [], "partialFingerprints": {"phpshield/v1": f["fingerprint"]}, }) return json.dumps({ "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0", "runs": [{"tool": {"driver": {"name": "phpshield", "version": env["version"], "informationUri": "https://phpshield.live/", "rules": rules}}, "results": results}], }, indent=2) def render_html(env, exit_code=0): import html rows = [] for f in env["findings"]: rows.append("%s%s%s
%s%s%s%s" % ( f["severity"], f["severity"].upper(), html.escape(f["id"]), html.escape(f["title"]), html.escape(f["location"]), (":%d" % f["line"]) if f.get("line") else "", ("
%s" % html.escape(f["evidence"])) if f.get("evidence") else "", html.escape(f["fix"]))) return """phpshield scan

phpshield scan

phpshield %s · data generated %s · scanned %s · %d findings · %s

%s
SeverityRuleFindingFix
""" % ( env["version"], env["data_generated_at"], html.escape(", ".join(env["target"])), env["summary"]["total"], html.escape(result_line(env, exit_code)), "\n".join(rows)) def render(env, fmt, paint, quiet=False, exit_code=0): if fmt == "json": return json.dumps(env, indent=2) if fmt == "sarif": return render_sarif(env) if fmt == "html": return render_html(env, exit_code) if fmt == "md": return render_md(env, exit_code) return render_text(env, paint, quiet, exit_code) def infer_format(output, fmt): if fmt: return fmt if output: ext = output.rsplit(".", 1)[-1].lower() if "." in output else "" if ext in ("json", "sarif", "html", "md"): return ext return "text" def write_out(text, output): if output: with open(output, "w", encoding="utf-8") as fh: fh.write(text + "\n") else: sys.stdout.write(text + "\n") PK+iX]I k5)5)phpshield/runtime.py"""Host inspection: PHP binaries, versions, stale workers, config files and platform detection.""" import glob import os import platform as _platform import re import shutil import subprocess import sys from . import data from .model import Finding from .versions import render_verdict, verdict_for CANDIDATES = ["php", "php8.5", "php8.4", "php8.3", "php8.2", "php8.1", "php8.0", "php7.4", "php-fpm", "php-cgi"] CANDIDATE_GLOBS = [ "/usr/bin/php*", "/usr/local/bin/php*", "/opt/homebrew/bin/php*", "/opt/homebrew/opt/php@*/bin/php", "/opt/remi/php*/root/usr/bin/php", "/opt/cpanel/ea-php*/root/usr/bin/php", "/opt/plesk/php/*/bin/php", "/opt/alt/php*/usr/bin/php", "/usr/local/lsws/lsphp*/bin/php", "/usr/local/php*/bin/php", ] INI_GLOBS = [ "/etc/php/*/fpm/php.ini", "/etc/php/*/cli/php.ini", "/etc/php/*/apache2/php.ini", "/etc/php/*/fpm/pool.d/*.conf", "/etc/php.ini", "/etc/php-fpm.d/*.conf", "/etc/php-fpm.conf", "/etc/php*/php.ini", "/opt/remi/php*/root/etc/php.ini", "/opt/cpanel/ea-php*/root/etc/php.ini", "/opt/plesk/php/*/etc/php.ini", "/usr/local/etc/php/*/php.ini", "/opt/homebrew/etc/php/*/php.ini", "/usr/local/lsws/lsphp*/etc/php.ini", ] def _run(cmd, timeout=8): try: p = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) return (p.stdout or "") + (p.stderr or "") except Exception: return "" def find_php_binaries(extra=None): found = [] for name in CANDIDATES: p = shutil.which(name) if p: found.append(p) for g in CANDIDATE_GLOBS: for p in glob.glob(g): if os.access(p, os.X_OK) and not os.path.isdir(p) and re.search(r"php(?:\d+(?:\.\d+)?)?(?:-fpm|-cgi)?$", os.path.basename(p)): found.append(p) for p in extra or []: found.append(p) out, seen = [], set() for p in found: try: real = os.path.realpath(p) except Exception: real = p if real not in seen: seen.add(real) out.append(p) return out def php_version_of(binary): out = _run([binary, "-v"]) m = re.search(r"PHP\s+(\d+\.\d+\.\d+)", out) return m.group(1) if m else None def php_sapi_of(binary): base = os.path.basename(binary) if "fpm" in base: return "fpm-fcgi" if "cgi" in base: return "cgi-fcgi" return "cli" def vendor_changelog(binary): """(package, changelog_text) from the distro package that owns binary, or (None, None). Distributions backport security fixes without bumping the upstream version string, so the package changelog is the only local evidence that a CVE is actually fixed.""" real = os.path.realpath(binary) pkg = None if shutil.which("dpkg"): out = _run(["dpkg", "-S", real]) if out and ":" in out: pkg = out.split(":", 1)[0].strip().split(",")[0] if pkg: import gzip for cand in (pkg, re.sub(r"-(?:cli|fpm|cgi|apache2|common)$", "-common", pkg)): for name in ("changelog.Debian.gz", "changelog.gz"): path = os.path.join("/usr/share/doc", cand, name) if os.path.isfile(path): try: with gzip.open(path, "rb") as fh: return pkg, fh.read(400000).decode("utf-8", "replace") except OSError: pass return pkg, None if shutil.which("rpm"): out = _run(["rpm", "-qf", real]) if out and "not owned" not in out: pkg = out.strip().splitlines()[0] log = _run(["rpm", "-q", "--changelog", pkg], timeout=15) return pkg, (log or None) return None, None def runtime_findings(binaries, windows=False): findings, installs = [], [] for b in binaries: v = php_version_of(b) if not v: continue verdict = verdict_for(v, windows=windows) installs.append({"binary": b, "version": v, "sapi": php_sapi_of(b), "status": verdict["status"], "upgrade_to": verdict["upgrade_to"]}) if verdict["status"] in ("critical", "high"): pkg, changelog = vendor_changelog(b) for h in verdict["advisories"]: if h["status"] not in ("vulnerable", "no-fix"): continue if changelog and h["cve"] in changelog: findings.append(Finding("HOST-PHP-VENDOR-BACKPORT", "info", "runtime", "%s: vendor package changelog records the fix" % h["cve"], b, None, "PHP %s from package %s; changelog mentions %s" % (v, pkg, h["cve"]), "The version string is below the fixed release, but the distribution's changelog says the fix was backported. Confirm every worker restarted after that package was installed; a worker started earlier still runs the old engine.", [h["url"]], "medium", {"version": v, "package": pkg})) continue note = "" if pkg and changelog: note = " The %s package changelog does not mention %s, so the version string stands." % (pkg, h["cve"]) elif pkg: note = " Package %s owns this binary but no changelog could be read; check it for %s before trusting the version string." % (pkg, h["cve"]) findings.append(Finding("HOST-PHP-VULNERABLE", h["severity"], "runtime", "%s: %s" % (h["cve"], h["title"]), b, None, "PHP %s (%s)" % (v, verdict["branch"]), verdict["detail"] + (" " + " ".join(verdict["notes"]) if verdict["notes"] else "") + note, [h["url"]], "high", {"version": v, "upgrade_to": verdict["upgrade_to"], "package": pkg})) elif verdict["status"] == "medium": findings.append(Finding("HOST-PHP-OUTDATED", "medium", "runtime", "PHP is behind the latest security release in its branch", b, None, "PHP %s" % v, verdict["detail"], ["https://www.php.net/supported-versions.php"])) if verdict["branch_status"] == "eol": findings.append(Finding("HOST-PHP-EOL", "high", "runtime", "PHP branch %s is end of life" % verdict["branch"], b, None, "PHP %s" % v, verdict["detail"], ["https://www.php.net/eol.php"])) findings.extend(stale_workers(binaries)) return findings, installs def stale_workers(binaries): """Workers that started before the PHP binary they run was last modified still hold the old engine.""" out = [] if sys.platform.startswith("win"): return out ps = _run(["ps", "-eo", "pid=,lstart=,comm=,args="], timeout=10) if not ps: return out bin_mtime = {} for b in binaries: try: bin_mtime[os.path.realpath(b)] = os.path.getmtime(b) except Exception: pass newest = max(bin_mtime.values()) if bin_mtime else None if newest is None: return out import datetime for line in ps.splitlines(): if not re.search(r"\b(?:php-fpm|php-cgi|lsphp|frankenphp|httpd|apache2)\b", line): continue m = re.match(r"\s*(\d+)\s+(\w{3}\s+\w{3}\s+\d+\s+\d+:\d+:\d+\s+\d{4})\s+(\S+)", line) if not m: continue try: started = datetime.datetime.strptime(m.group(2), "%a %b %d %H:%M:%S %Y").timestamp() except Exception: continue if started < newest: out.append(Finding("HOST-STALE-WORKER", "high", "runtime", "Worker started before the current PHP binary (still runs the old engine)", "pid %s (%s)" % (m.group(1), m.group(3)), None, "started %s" % m.group(2), "Restart this service so every worker loads the patched binary: the upgrade only protects new processes.", ["https://www.php.net/archive/2026.php"], "medium")) return out[:50] def find_ini_files(extra=None): found = [] for g in INI_GLOBS: found.extend(glob.glob(g)) for b in find_php_binaries(): out = _run([b, "--ini"]) for m in re.finditer(r"Loaded Configuration File:\s*(\S+)", out): if m.group(1) != "(none)": found.append(m.group(1)) found.extend(extra or []) out, seen = [], set() for f in found: if os.path.isfile(f) and f not in seen: seen.add(f) out.append(f) return out def os_release_id(): try: with open("/etc/os-release") as fh: for line in fh: if line.startswith("ID="): return line.strip().split("=", 1)[1].strip('"') except Exception: pass if sys.platform == "darwin": return "macos" if sys.platform.startswith("win"): return "windows" return "" def detect_platform(): osid = os_release_id() if osid == "windows": return "windows" for p in data.platforms()["platforms"]: d = p.get("detect") or {} if any(glob.glob(os.path.expanduser(x)) for x in d.get("paths", [])) and (not d.get("osReleaseIds") or osid in d.get("osReleaseIds", [])): if d.get("paths"): return p["id"] if osid == "macos": return "homebrew" if shutil.which("brew") else "herd-valet" for p in data.platforms()["platforms"]: d = p.get("detect") or {} if osid and osid in d.get("osReleaseIds", []) and not d.get("paths"): return p["id"] return "source" def detect_branch(): for b in find_php_binaries(): v = php_version_of(b) if v: return ".".join(v.split(".")[:2]) return None def detect_sapi(): ps = _run(["ps", "-eo", "comm="], timeout=10) if not sys.platform.startswith("win") else "" if "php-fpm" in ps: return "fpm-fcgi" if "frankenphp" in ps: return "frankenphp" if "lsphp" in ps or "litespeed" in ps: return "litespeed" if "httpd" in ps or "apache2" in ps: return "apache2handler" if "php-cgi" in ps: return "cgi-fcgi" return "cli" def host_summary(windows=False, paint=None): lines = [] for b in find_php_binaries(): v = php_version_of(b) if v: lines.append("%s: %s" % (b, render_verdict(verdict_for(v, windows=windows), paint).split("\n")[2].strip())) return lines def is_windows(): return sys.platform.startswith("win") or _platform.system().lower().startswith("win") PK+iX]Sphpshield/scan.py"""The six-check scan: runtime, config, deps, code, crypto, integrity.""" import datetime import fnmatch import os from . import codescan, composer, crypto, ini, runtime, wordpress from .model import Finding CHECKS = ["runtime", "config", "deps", "code", "crypto", "integrity"] SKIP_DIRS = set(["node_modules", "vendor", ".git", ".svn", ".hg", "__pycache__"]) BINARY_EXT = (".jpg", ".jpeg", ".png", ".gif", ".webp", ".ico", ".pdf", ".zip", ".gz", ".tgz", ".tar", ".bz2", ".xz", ".7z", ".rar", ".woff", ".woff2", ".ttf", ".otf", ".mp3", ".mp4", ".exe", ".dll", ".so", ".dylib", ".jar", ".wasm") UPLOAD_DIRS = ("uploads", "upload", "media", "files", "images") def _excluded(rel, patterns): return any(fnmatch.fnmatch(rel, p) or fnmatch.fnmatch(os.path.basename(rel), p) for p in patterns) def walk(root, exclude): if os.path.isfile(root): yield root, os.path.basename(root) return for dirpath, dirnames, filenames in os.walk(root): dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS and not _excluded(os.path.relpath(os.path.join(dirpath, d), root), exclude)] for f in sorted(filenames): full = os.path.join(dirpath, f) rel = os.path.relpath(full, root) if _excluded(rel, exclude): continue yield full, rel def read_text(path, limit): try: if os.path.getsize(path) > limit: return None with open(path, "rb") as fh: return fh.read().decode("utf-8", "replace") except Exception: return None def run(paths, opts, log=lambda s: None): """Returns (findings, errors, installs).""" findings, errors, installs = [], [], [] skip = set(opts.get("skip") or []) max_bytes = int(opts.get("max_file_size", 2) * 1024 * 1024) since = opts.get("since") or datetime.date(2026, 10, 20) exclude = opts.get("exclude") or [] system = opts.get("system", True) if system and "runtime" not in skip: log("runtime: inspecting PHP binaries and workers") bins = runtime.find_php_binaries(opts.get("php")) f, installs = runtime.runtime_findings(bins, windows=runtime.is_windows()) findings.extend(f) if "config" not in skip: inis = list(opts.get("ini") or []) if system: inis = runtime.find_ini_files(inis) for ini_path in inis: text = read_text(ini_path, max_bytes) if text is None: continue log("config: " + ini_path) fs, _ = ini.audit_text(text, ini_path) findings.extend(fs) for root in paths: root = os.path.abspath(root) if not os.path.exists(root): errors.append("path not found: " + root) continue display_root = os.path.basename(root.rstrip(os.sep)) or root if "integrity" not in skip and os.path.isdir(root): try: findings.extend(wordpress.audit(root, display_root, log)) except Exception as e: errors.append("wordpress %s: %s" % (display_root, e)) for full, rel in walk(root, exclude): base = os.path.basename(full) display = os.path.join(display_root, rel) if os.path.isdir(root) else display_root if "config" not in skip and base in ("php.ini", ".user.ini", "php-fpm.conf") and os.path.isdir(root): text = read_text(full, max_bytes) if text is not None: fs, _ = ini.audit_text(text, display) findings.extend(fs) if "deps" not in skip and base == "composer.lock": text = read_text(full, max_bytes) if text is not None: try: fs, _ = composer.audit_lock(text, display) findings.extend(fs) except Exception as e: errors.append("composer.lock %s: %s" % (display, e)) lower = base.lower() in_uploads = any(("/" + rel.replace(os.sep, "/")).find("/%s/" % d) >= 0 for d in UPLOAD_DIRS) if lower.endswith(BINARY_EXT) and not in_uploads: continue text = read_text(full, max_bytes) if text is None: continue if "code" not in skip or "integrity" not in skip: for f in codescan.scan_text(full, text, display): if f.category == "integrity" and "integrity" in skip: continue if f.category in ("code", "compromise") and "code" in skip: continue findings.append(f) if "code" not in skip: recent = codescan.recent_modification(full, display, since) if recent: findings.append(recent) if "crypto" not in skip: findings.extend(crypto.scan_text(full, text, display)) # the same rule can match twice on one line (eval and system); keep one seen, unique = set(), [] for f in findings: if f.fingerprint in seen: continue seen.add(f.fingerprint) unique.append(f) return unique, errors, installs PK+iX]Xפ$$phpshield/versions.py"""PHP version extraction and verdicts, mirroring lib/versions.ts.""" import datetime import re from . import data VERSION_PATTERNS = [ re.compile(r"PHP\s+Version\s*(?:=>)?\s*v?(\d+\.\d+\.\d+)", re.I), re.compile(r"\bPHP\s+v?(\d+\.\d+\.\d+)", re.I), re.compile(r"X-Powered-By:\s*PHP/(\d+\.\d+\.\d+)", re.I), re.compile(r"PHP/(\d+\.\d+\.\d+)", re.I), re.compile(r"^\s*php\s+v?(\d+\.\d+\.\d+)\s*$", re.I | re.M), re.compile(r"(?:^|[\s\"'=:(])v?(\d+\.\d+\.\d+)(?:[-+][\w.]*)?(?=$|[\s\"')\],;])", re.M), ] def parts(v): p = [int(x) if x.isdigit() else 0 for x in v.split(".")] while len(p) < 3: p.append(0) return tuple(p[:3]) def cmp(a, b): pa, pb = parts(a), parts(b) return (pa > pb) - (pa < pb) def extract_versions(text): text = re.sub(r"<[^>]+>", " ", text).replace(" ", " ") out, seen = [], set() def push(v): v = v.lstrip("v") major = int(v.split(".")[0]) if major not in (5, 7, 8, 9): return if v not in seen: seen.add(v) out.append(v) labelled = bool(re.search(r"PHP|X-Powered", text, re.I)) for i, rx in enumerate(VERSION_PATTERNS): for m in rx.finditer(text): push(m.group(1)) if out and labelled and i <= 2: continue if not out: m = re.match(r"^v?(\d+\.\d+)(?:\.(\d+))?$", text.strip()) if m: push("%s.%s" % (m.group(1), m.group(2) or "0")) return out def branch_status(branch, today=None): b = data.branches().get(branch) if not b: return "unknown" t = (today or datetime.date.today()).isoformat() if b.get("activeUntil") and t <= b["activeUntil"]: return "active" if t <= b["securityUntil"]: return "security" return "eol" def supported_branches(today=None): active, security = [], [] for b in data.branches(): s = branch_status(b, today) if s == "active": active.append(b) elif s == "security": security.append(b) key = lambda x: tuple(int(p) for p in x.split(".")) return sorted(active, key=key, reverse=True), sorted(security, key=key, reverse=True) def _evaluate(adv, version, branch): fixed = adv["fixed"].get(branch) base = {"id": adv["id"], "cve": adv["cve"], "name": adv["name"], "title": adv["title"], "severity": adv["severity"], "exploited_in_wild": adv["exploitedInWild"], "url": adv["ghsaUrl"], "fixed_in": fixed} intro = adv.get("introduced") if intro: im, imn, _ = parts(intro) vm, vmn, _ = parts(version) if vm < im or (vm == im and vmn < imn): return dict(base, status="not-applicable") branches = sorted(adv["fixed"].keys(), key=lambda x: tuple(int(p) for p in x.split("."))) if fixed: return dict(base, status="fixed" if cmp(version, fixed) >= 0 else "vulnerable") if cmp(branch + ".0", branches[-1] + ".0") > 0: return dict(base, status="not-applicable") return dict(base, fixed_in=None, status="no-fix") def verdict_for(version, windows=False, today=None): rel = data.releases() major, minor, _ = parts(version) branch = "%d.%d" % (major, minor) status = branch_status(branch, today) info = rel.get("branches", {}).get(branch) or {} latest = info.get("latest") known = version in rel.get("releases", {}) missing = [v for v in info.get("security", []) if cmp(v, version) > 0] active, security = supported_branches(today) recommended = active or security[:2] newest = (rel["branches"].get(recommended[0], {}).get("latest") if recommended else None) hits, worst = [], None order = ["info", "low", "medium", "high", "critical"] for adv in data.advisories(): if adv.get("scope") and adv["scope"] != "engine": continue # config/ecosystem advisories are listed, not judged from a version if adv.get("windowsOnly") and not windows: continue h = _evaluate(adv, version, branch) if h["status"] == "not-applicable": continue hits.append(h) if h["status"] in ("vulnerable", "no-fix") and (worst is None or order.index(adv["severity"]) > order.index(worst)): worst = adv["severity"] vulnerable = [h for h in hits if h["status"] in ("vulnerable", "no-fix")] php2shell = [a for a in data.advisories() if a["name"] == "PHP2Shell"][0] p2s_fix = php2shell["fixed"].get(branch) notes = [] if status in ("eol", "unknown"): v = ("critical" if worst == "critical" else "high") if vulnerable else "high" headline = "PHP %s is on branch %s, which is end of life%s" % (version, branch, " and affected by a critical, actively exploited vulnerability" if vulnerable else "") detail = "Branch %s receives no security releases. Migrate to a supported branch%s now." % (branch, " (%s)" % newest if newest else "") upgrade = newest if php2shell.get("eolNote") and any(h["name"] == "PHP2Shell" for h in vulnerable): notes.append(php2shell["eolNote"]) elif vulnerable: v = "critical" if worst == "critical" else ("high" if worst == "high" else "medium") fix = p2s_fix or latest headline = "PHP %s is affected by a %s, %svulnerability" % (version, worst, "actively exploited " if any(h["exploited_in_wild"] for h in vulnerable) else "") detail = ("Upgrade to %s now." % fix) if fix else "Upgrade to the latest release of a supported branch now." upgrade = fix elif latest and cmp(version, latest) < 0: v = "medium" if missing else "low" headline = "PHP %s carries the PHP2Shell fix but is behind %s" % (version, latest) detail = ("%d later security release%s on branch %s. Upgrade to %s." % (len(missing), "s" if len(missing) > 1 else "", branch, latest)) if missing else ("Branch %s is at %s; the difference is bug fixes only." % (branch, latest)) upgrade = latest else: v = "ok" headline = "PHP %s is the latest release on branch %s" % (version, branch) detail = ("Branch %s is in security-only support until %s." % (branch, data.branches()[branch]["securityUntil"])) if status == "security" else ("Branch %s is in active support." % branch) upgrade = None if not known and status != "unknown": notes.append("%s is not a release php.net lists for branch %s; distributions and vendors backport fixes under their own numbers, so confirm against the vendor advisory." % (version, branch)) if status == "security" and v != "ok": notes.append("Branch %s is in security-only support until %s." % (branch, data.branches()[branch]["securityUntil"])) return { "input": version, "version": version, "branch": branch, "known": known, "branch_status": status, "branch_security_until": data.branches().get(branch, {}).get("securityUntil"), "latest_in_branch": latest, "is_latest": bool(latest) and cmp(version, latest) >= 0, "missing_security_releases": missing, "advisories": hits, "status": v, "headline": headline, "detail": detail, "upgrade_to": upgrade, "recommended_branches": recommended, "notes": notes, "windows": windows, } LABEL = {"critical": "CRITICAL", "high": "HIGH", "medium": "OUTDATED", "low": "BEHIND", "ok": "PATCHED", "unknown": "UNKNOWN"} def wrap(text, width=62): out, line = [], "" for w in text.split(): if len((line + " " + w).strip()) > width: out.append(line.strip()) line = w else: line = (line + " " + w).strip() if line: out.append(line) return out def render_verdict(v, paint=None, tool="phpshield"): paint = paint or (lambda s, _c: s) rel = data.releases() lines = ["$ %s version %s%s" % (tool, v["version"], " --windows" if v["windows"] else ""), ""] lines.append(" PHP %s %s" % (v["version"], paint(LABEL[v["status"]], v["status"]))) lines.append("") for l in wrap("%s. %s" % (v["headline"], v["detail"])): lines.append(" " + l) if v["advisories"]: lines += ["", " Advisories:"] for h in v["advisories"]: tags = ["fixed in %s" % h["fixed_in"] if h["status"] != "no-fix" else "no official fix for branch %s" % v["branch"]] if h["exploited_in_wild"]: tags.append("exploited in the wild") lines.append(" %s %s %s %s" % (h["cve"], h["name"], h["severity"], " ".join("[%s]" % t for t in tags))) if v["missing_security_releases"]: lines.append("") for l in wrap("Missing security releases on branch %s: %s" % (v["branch"], ", ".join(v["missing_security_releases"]))): lines.append(" " + l) lines.append("") if v["upgrade_to"]: lines.append(" Upgrade to: %s" % v["upgrade_to"]) if v["recommended_branches"]: lines.append(" Branches in active support: " + " ".join("%s -> %s" % (b, rel["branches"].get(b, {}).get("latest", "?")) for b in v["recommended_branches"])) for n in v["notes"]: for l in wrap(n): lines.append(" " + l) lines += ["", " data: php.net · generated %s" % data.data_generated_at()] return "\n".join(lines) PK+iX]٦0SkFkFphpshield/wallet.py"""Read-only Solana lookups: wallet activity (with --watch) and token delegations. Never signs or sends.""" import datetime import json import os import time from . import net from .crypto import b58decode from .data import CACHE_DIR DEFAULT_RPC = "https://api.mainnet-beta.solana.com" TOKEN = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA" TOKEN_2022 = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb" def valid_address(s): try: return len(b58decode(s.strip())) == 32 except Exception: return False def rpc(url, method, params): res = net.post_json(url, {"jsonrpc": "2.0", "id": 1, "method": method, "params": params}, timeout=25) if res is None or "error" in res: raise RuntimeError("rpc %s failed: %s" % (method, (res or {}).get("error"))) return res["result"] def _ts(bt): return datetime.datetime.utcfromtimestamp(bt).strftime("%Y-%m-%d %H:%M:%SZ") if bt else "slot" def signatures(url, address, limit=100, until=None, since=None): params = [address, {"limit": min(1000, max(1, limit))}] if until: params[1]["until"] = until out = rpc(url, "getSignaturesForAddress", params) or [] if since: ts = datetime.datetime.combine(since, datetime.time.min, tzinfo=datetime.timezone.utc).timestamp() out = [s for s in out if not s.get("blockTime") or s["blockTime"] >= ts] return out # ── what a transaction did, from the point of view of one address (mirrors lib/activity.ts) ── PROGRAM_LABELS = { "11111111111111111111111111111111": "System", "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA": "Token", "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb": "Token-2022", "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL": "Associated Token", "ComputeBudget111111111111111111111111111111": "Compute Budget", "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr": "Memo", "Memo1UhkJRfHyvLMcVucJwxXeuD728EqVDDwQDxFMNo": "Memo", "JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4": "Jupiter", "JUP4Fb2cqiRUcaTHdrPC8h2gNsA2ETXiPDD33WcGuJB": "Jupiter", "jupoNjAxXgZ4rjzxzPMP4oxduvQsQtZzyknqvzYNrNu": "Jupiter Limit", "675kPX9MHTjS2zt1qfr1NYHuzeLXfQM9H24wFSUt1Mp8": "Raydium", "CPMMoo8L3F4NbTegBCKVNunggL7H1ZpdTHKxQB5qKP1C": "Raydium CPMM", "CAMMCzo5YL8w4VFF8KVHrK22GGUsp5VTaW7grrKgrWqK": "Raydium CLMM", "6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P": "pump.fun", "pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA": "PumpSwap", "pfeeUxB6jkeY1Hxd7CsFCAjcbHA9rWtchMGdZ6VojVZ": "pump.fun fees", "whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc": "Orca", "LBUZKhRxPF3XUpBCjp4YzTKgLccjZhTSDM9YuVaPwxo": "Meteora DLMM", "Eo7WjKq67rjJQSZxS6z3YkapzY3eMj6Xy8X5EQVn5UaB": "Meteora", "TSWAPaqyCSx2KABk68Shruf4rp7CxcNi8hAsbdwmHbN": "Tensor", "M2mx93ekt1fmXSVkTrUL9xVFHkmME8HTUi5Cyc5aF7K": "Magic Eden", "Stake11111111111111111111111111111111111111": "Stake", "Vote111111111111111111111111111111111111111": "Vote", } DEX = set(["Jupiter", "Jupiter Limit", "Raydium", "Raydium CPMM", "Raydium CLMM", "pump.fun", "PumpSwap", "Orca", "Meteora DLMM", "Meteora"]) NOISE = set(["Compute Budget", "Associated Token", "pump.fun fees"]) MOVES = set(["sol-out", "token-out", "approve", "set-authority", "close-account", "swap"]) def short(a): return "%s...%s" % (a[:4], a[-4:]) if a and len(a) > 12 else (a or "?") def fmt_sol(lamports): v = lamports / 1e9 s = ("%.4f" if abs(v) >= 1 else "%.6f") % v return s.rstrip("0").rstrip(".") if "." in s else s def interpret(tx, owner, signer): """{programs, events, token_changes, risk, summary}: what the transaction did for owner.""" meta = tx.get("meta") or {} events, programs, seen = [], [], set() TOKEN = ("Token", "Token-2022") def add_program(pid, name): label = PROGRAM_LABELS.get(pid) or (name if name and name not in ("system", "spl-token", "spl-token-2022", "spl-associated-token-account", "spl-memo") else short(pid)) if label not in seen: seen.add(label) programs.append(label) return label ixs = list(tx["transaction"]["message"].get("instructions", [])) for inner in meta.get("innerInstructions") or []: ixs.extend(inner.get("instructions", [])) for ix in ixs: label = add_program(ix.get("programId", ""), ix.get("program")) parsed = ix.get("parsed") if isinstance(ix.get("parsed"), dict) else None info = (parsed or {}).get("info") or {} t = (parsed or {}).get("type") or "" ta = info.get("tokenAmount") if isinstance(info.get("tokenAmount"), dict) else None amount = (ta or {}).get("uiAmountString") or (str(info["amount"]) if "amount" in info else "?") if label == "System" and t == "transfer": lam = int(info.get("lamports") or 0) if info.get("source") == owner: events.append({"kind": "sol-out", "text": "Sent %s SOL to %s" % (fmt_sol(lam), short(info.get("destination"))), "counterparty": info.get("destination")}) elif info.get("destination") == owner: events.append({"kind": "sol-in", "text": "Received %s SOL from %s" % (fmt_sol(lam), short(info.get("source"))), "counterparty": info.get("source")}) elif label in TOKEN and t in ("transfer", "transferChecked"): if info.get("authority") == owner or info.get("multisigAuthority") == owner: mint = info.get("mint") events.append({"kind": "token-out", "text": "Sent %s%s to token account %s" % (amount, " of %s" % short(mint) if mint else " tokens", short(info.get("destination"))), "counterparty": info.get("destination")}) elif label in TOKEN and t in ("approve", "approveChecked"): if info.get("owner") == owner: events.append({"kind": "approve", "text": "Approved delegate %s to spend %s from %s" % (short(info.get("delegate")), amount, short(info.get("source"))), "counterparty": info.get("delegate")}) elif label in TOKEN and t == "revoke": if info.get("owner") == owner: events.append({"kind": "revoke", "text": "Revoked the delegate on %s" % short(info.get("source"))}) elif label in TOKEN and t == "setAuthority": if info.get("authority") == owner: events.append({"kind": "set-authority", "text": "Changed %s authority of %s to %s" % (info.get("authorityType") or "an", short(info.get("account") or info.get("mint")), short(info.get("newAuthority") or "none")), "counterparty": info.get("newAuthority")}) elif label in TOKEN and t == "closeAccount": if info.get("owner") == owner: events.append({"kind": "close-account", "text": "Closed token account %s, rent to %s" % (short(info.get("account")), short(info.get("destination"))), "counterparty": info.get("destination")}) elif label == "System" and t in ("createAccount", "createAccountWithSeed"): if info.get("source") == owner: events.append({"kind": "create-account", "text": "Created account %s (%s SOL rent)" % (short(info.get("newAccount")), fmt_sol(int(info.get("lamports") or 0)))}) elif label == "Memo": events.append({"kind": "memo", "text": "Memo attached"}) elif label in DEX: if not any(e["kind"] == "swap" and e["text"].startswith(label) for e in events): events.append({"kind": "swap", "text": "%s swap" % label}) elif not parsed and label not in NOISE and label != "System": if not any(e["kind"] == "program" and label in e["text"] for e in events): events.append({"kind": "program", "text": "Interacted with %s" % label}) pre, post = {}, {} for b in meta.get("preTokenBalances") or []: if b.get("owner") == owner: pre["%s:%s" % (b.get("accountIndex"), b.get("mint"))] = (b.get("uiTokenAmount") or {}).get("uiAmount") or 0 for b in meta.get("postTokenBalances") or []: if b.get("owner") == owner: post["%s:%s" % (b.get("accountIndex"), b.get("mint"))] = (b.get("uiTokenAmount") or {}).get("uiAmount") or 0 token_changes = [] for key in sorted(set(pre) | set(post)): change = (post.get(key) or 0) - (pre.get(key) or 0) if change: token_changes.append({"mint": key.split(":")[1], "change": change}) for c in token_changes: if not any(short(c["mint"]) in e["text"] for e in events): events.append({"kind": "token-out" if c["change"] < 0 else "token-in", "text": "%s%s %s" % ("-" if c["change"] < 0 else "+", ("%.6f" % abs(c["change"])).rstrip("0").rstrip("."), short(c["mint"]))}) # a swap is one action: fold its fee hops and legs into a single net line swap = next((e for e in events if e["kind"] == "swap"), None) if swap: keys = tx["transaction"]["message"]["accountKeys"] idx = next((i for i, k in enumerate(keys) if (k.get("pubkey") if isinstance(k, dict) else k) == owner), None) lam = (meta["postBalances"][idx] - meta["preBalances"][idx]) if idx is not None and meta.get("postBalances") else 0 legs = ([("+" if lam > 0 else "") + fmt_sol(lam) + " SOL"] if lam else []) + ["%s%s %s" % ("+" if c["change"] > 0 else "-", ("%.6f" % abs(c["change"])).rstrip("0").rstrip("."), short(c["mint"])) for c in token_changes] hops = sum(1 for e in events if e["kind"] == "sol-out") kept = [e for e in events if e["kind"] not in ("sol-out", "sol-in", "token-out", "token-in", "create-account", "swap", "memo")] events = [{"kind": "swap", "text": "%s: %s%s" % (swap["text"], ", ".join(legs) or "no net change", " (%d fee and tip transfers)" % hops if hops > 1 else "")}] + kept failed = bool(meta.get("err")) moved = any(e["kind"] in MOVES for e in events) risk = "none" if signer: risk = "warning" if failed else ("critical" if moved else "info") visible = [x for x in programs if x not in NOISE] summary = " · ".join(e["text"] for e in events) if events else ("Interacted with " + ", ".join(visible) if visible else "No balance change for this wallet") return {"programs": visible, "events": events, "token_changes": token_changes, "risk": risk, "summary": summary} def transaction_detail(url, address, sig): try: # 255 is a ceiling, not a request: nodes return whatever message version the transaction has (v1 is live on mainnet) tx = rpc(url, "getTransaction", [sig, {"encoding": "jsonParsed", "maxSupportedTransactionVersion": 255}]) except Exception as e: return {"signer": None, "sol_change_lamports": None, "lookup_error": str(e)} if not tx: return {"signer": None, "sol_change_lamports": None, "lookup_error": "not found"} keys = tx["transaction"]["message"]["accountKeys"] idx = None for i, k in enumerate(keys): pk = k["pubkey"] if isinstance(k, dict) else k if pk == address: idx = i break signer = bool(keys[idx].get("signer")) if idx is not None and isinstance(keys[idx], dict) else (idx is not None and idx < tx["transaction"]["message"].get("header", {}).get("numRequiredSignatures", 1)) meta = tx.get("meta") or {} change = (meta["postBalances"][idx] - meta["preBalances"][idx]) if idx is not None and meta.get("postBalances") else None out = {"signer": signer, "sol_change_lamports": change, "err": meta.get("err")} try: out["detail"] = interpret(tx, address, signer) except Exception as e: # interpretation is best-effort; the signer verdict stands on its own out["detail"] = {"programs": [], "events": [], "token_changes": [], "risk": "warning" if signer else "none", "summary": "could not interpret: %s" % e} return out def activity(url, address, limit=25, since=None, detail=10): sigs = signatures(url, address, limit=limit, since=since) out = [] for i, s in enumerate(sigs): row = {"signature": s["signature"], "slot": s.get("slot"), "block_time": s.get("blockTime"), "err": s.get("err")} if i < detail: row.update(transaction_detail(url, address, s["signature"])) else: row.update({"signer": None, "sol_change_lamports": None}) out.append(row) return out def format_row(r): d = r.get("detail") or {} if r.get("signer") is None: tag = "signer unknown " elif not r.get("signer"): tag = "not signer " elif d.get("risk") == "critical": tag = "SIGNED, MOVED " elif r.get("err"): tag = "SIGNED, FAILED " else: tag = "SIGNED " sol = ("SOL %+.9f" % (r["sol_change_lamports"] / 1e9)).rstrip("0").rstrip(".") if r.get("sol_change_lamports") is not None else "" line = " %s %s %-6s %-18s %s" % (tag, _ts(r.get("block_time")), "FAILED" if r.get("err") else "ok", sol, r["signature"]) if d.get("summary"): line += "\n%s%s%s" % (" " * 20, d["summary"], (" [" + ", ".join(d["programs"]) + "]") if d.get("programs") else "") return line def watch(url, address, interval, once, state_path, webhook, webhook_fmt, limit, as_json): state_path = state_path or os.path.join(CACHE_DIR, "wallet-%s.json" % address) while True: stamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S") try: with open(state_path) as fh: st = json.load(fh) except Exception: st = None try: if not st: sigs = signatures(url, address, limit=1) newest = sigs[0] if sigs else None st = {"address": address, "newest": newest["signature"] if newest else None, "slot": newest.get("slot") if newest else None, "updated": stamp} os.makedirs(os.path.dirname(state_path), exist_ok=True) with open(state_path, "w") as fh: json.dump(st, fh) if as_json: print(json.dumps({"tool": "phpshield", "address": address, "baseline": st["newest"]})) else: print("[%s] phpshield wallet watch: %s" % (stamp, address)) print(" baseline: newest transaction is %s (%s)" % (st["newest"] or "none", _ts(newest.get("blockTime")) if newest else "-")) print(" nothing is reported on the first run; later runs report anything newer") code = 0 else: fresh = signatures(url, address, limit=limit, until=st.get("newest")) rows = [dict({"signature": s["signature"], "slot": s.get("slot"), "block_time": s.get("blockTime"), "err": s.get("err")}, **transaction_detail(url, address, s["signature"])) for s in fresh] signed = [r for r in rows if r.get("signer")] if rows: st.update({"newest": rows[0]["signature"], "slot": rows[0]["slot"], "updated": stamp}) with open(state_path, "w") as fh: json.dump(st, fh) if as_json: print(json.dumps({"tool": "phpshield", "address": address, "new": rows})) elif rows: print("[%s] phpshield wallet watch: %d new transaction(s), %d SIGNED BY THIS WALLET for %s" % (stamp, len(rows), len(signed), address)) for r in rows: print(format_row(r)) if signed: print(" A transaction signed by this wallet needs its private key. If you did not\n make it, assume the key is compromised and move what is left to a new wallet.") else: print("[%s] phpshield wallet watch: no new transactions for %s" % (stamp, address)) if rows and webhook: text = "phpshield wallet watch: %d new transaction(s) for %s, %d signed by this wallet\n\n" % (len(rows), address, len(signed)) + "\n".join("• %s\n https://explorer.solana.com/tx/%s" % (format_row(r).strip(), r["signature"]) for r in rows) if signed: text += "\n\nTransactions signed by this wallet need its private key. If you did not make them, assume the key is compromised and move what is left to a new wallet." body = {"text": text} if webhook_fmt == "slack" else ({"content": text[:1900]} if webhook_fmt == "discord" else {"tool": "phpshield", "address": address, "new": rows}) try: net.post_json(webhook, body) print(" webhook: delivered (%s)" % webhook_fmt) except Exception as e: print(" webhook: failed: %s" % e) code = 1 if signed else 0 except Exception as e: print("phpshield wallet watch: lookup failed: %s" % e) code = 2 if once: return code print("phpshield wallet watch: next check in %ds (Ctrl-C to stop)" % interval) try: time.sleep(interval) except KeyboardInterrupt: print("phpshield wallet watch: stopped") return 0 def delegations(url, owner): out, count = [], 0 for program, label in ((TOKEN, "spl-token"), (TOKEN_2022, "token-2022")): res = rpc(url, "getTokenAccountsByOwner", [owner, {"programId": program}, {"encoding": "jsonParsed"}]) for acc in res.get("value", []): count += 1 info = acc["account"]["data"]["parsed"]["info"] if not info.get("delegate"): continue out.append({ "account": acc["pubkey"], "mint": info.get("mint"), "program": label, "amount": (info.get("tokenAmount") or {}).get("uiAmountString"), "decimals": (info.get("tokenAmount") or {}).get("decimals"), "delegate": info["delegate"], "delegated_amount": (info.get("delegatedAmount") or {}).get("uiAmountString"), }) return out, count PK+iX]9faΦphpshield/wordpress.py"""WordPress core integrity: compare core files with the official checksums for the installed version.""" import hashlib import os import re import urllib.parse from . import net from .model import Finding CHECKSUMS_API = "https://api.wordpress.org/core/checksums/1.0/" REFS = ["https://developer.wordpress.org/advanced-administration/security/hardening/", "https://developer.wordpress.org/advanced-administration/security/hardening/#wordpress-core-file-integrity"] CORE_DIRS = ("wp-admin", "wp-includes") def detect(root): """(install_dir, version) for a WordPress install at root or one directory below it, else (None, None).""" if not os.path.isdir(root): return None, None cands = [root] try: cands += [os.path.join(root, d) for d in sorted(os.listdir(root)) if os.path.isdir(os.path.join(root, d)) and not d.startswith(".")] except OSError: pass for c in cands: vf = os.path.join(c, "wp-includes", "version.php") if not os.path.isfile(vf): continue try: with open(vf, "rb") as fh: txt = fh.read(20000).decode("utf-8", "replace") except OSError: continue m = re.search(r"\$wp_version\s*=\s*'([^']+)'", txt) if m: return c, m.group(1) return None, None def checksums(version, locale="en_US"): data = net.get_json(CHECKSUMS_API + "?" + urllib.parse.urlencode({"version": version, "locale": locale})) cs = (data or {}).get("checksums") return cs if isinstance(cs, dict) and cs else None def _md5(path): h = hashlib.md5() with open(path, "rb") as fh: for chunk in iter(lambda: fh.read(1 << 16), b""): h.update(chunk) return h.hexdigest() def audit(root, display_root, log=lambda s: None): """Findings for a WordPress tree under root: modified core files and PHP files core never ships.""" wp, version = detect(root) if not wp: return [] rel = os.path.relpath(wp, root) loc = display_root if rel == "." else os.path.join(display_root, rel) log("integrity: WordPress %s at %s" % (version, loc)) api_url = CHECKSUMS_API + "?version=%s&locale=en_US" % version try: cs = checksums(version) except net.Offline: return [Finding("INT-WP-OFFLINE-SKIPPED", "info", "integrity", "WordPress core checksum check skipped (offline)", loc, None, "WordPress %s" % version, "Run without --offline to compare every core file with the official checksums from api.wordpress.org.", [api_url] + REFS, "high")] except Exception as e: cs = None err = str(e) else: err = "no checksums published for this version" if cs is None: return [Finding("INT-WP-CHECKSUMS-UNAVAILABLE", "info", "integrity", "Could not fetch WordPress core checksums", loc, None, "WordPress %s: %s" % (version, err), "The API only knows released versions. Confirm the version string in wp-includes/version.php and retry; until then compare core files with a clean download by hand.", [api_url] + REFS, "medium")] out = [] for relpath in sorted(cs): full = os.path.join(wp, relpath) if not os.path.isfile(full): continue try: got = _md5(full) except OSError: continue if got != cs[relpath]: in_content = relpath.startswith("wp-content/") out.append(Finding("INT-WP-CORE-MODIFIED", "high", "integrity", "WordPress core file differs from the official release", os.path.join(loc, relpath), None, "md5 %s, release %s (WordPress %s)" % (got[:12], cs[relpath][:12], version), "WordPress never edits its own core files, so a changed one is a manual patch or an injected backdoor. Diff it against a clean copy of WordPress %s, restore it from the official package, then look for what wrote to it." % version, [api_url] + REFS, "medium" if in_content else "high")) for sub in CORE_DIRS: for dirpath, dirnames, filenames in os.walk(os.path.join(wp, sub)): for f in filenames: if not f.lower().endswith((".php", ".phtml", ".phar")): continue rp = os.path.relpath(os.path.join(dirpath, f), wp).replace(os.sep, "/") if rp not in cs: out.append(Finding("INT-WP-UNKNOWN-CORE-FILE", "critical", "integrity", "PHP file inside WordPress core that the release does not ship", os.path.join(loc, rp), None, "not in the WordPress %s manifest" % version, "Nothing legitimate adds PHP files to wp-admin or wp-includes after install. Treat it as a dropped webshell: preserve a copy for forensics, remove it, rotate every credential the site holds and re-scan.", [api_url] + REFS, "high")) return out[:300] PK+iX]-a<< __main__.pyPK+iX] A|phpshield/PK+iX]u{eephpshield/__init__.pyPK+iX]-a<<<phpshield/__main__.pyPK+iX]]11phpshield/cli.pyPK+iX]j+uu3phpshield/codescan.pyPK+iX]>mGIphpshield/composer.pyPK+iX]s[phpshield/crypto.pyPK+iX]Arphpshield/data/PK+iX][#2#2sphpshield/data/advisories.jsonPK+iX]<3<3 |phpshield/data/bip39-english.txtPK+iX]arrphpshield/data/branches.jsonPK+iX]Q=phpshield/data/code-rules.jsonPK+iX], phpshield/data/crypto-rules.jsonPK+iX]􌸽GGphpshield/data/ini-rules.jsonPK+iX]bI Vphpshield/data/php-releases.jsonPK+iX]b|zphpshield/data/platforms.jsonPK+iX]PJ^%%phpshield/data.pyPK+iX]000 phpshield/fix.pyPK+iX]H1MMiphpshield/ini.pyPK+iX]ѕ^phpshield/model.pyPK+iX]fQ\\phpshield/monitor.pyPK+iX]Q\phpshield/net.pyPK+iX]]/¢b b [phpshield/report.pyPK+iX]I k5)5)phpshield/runtime.pyPK+iX]SUBphpshield/scan.pyPK+iX]Xפ$$,Wphpshield/versions.pyPK+iX]٦0SkFkF|phpshield/wallet.pyPK+iX]9faΦphpshield/wordpress.pyPK{