About php2shell.eu

php2shell.eu was put up on the day PHP2Shell was disclosed, for the people who have to act on it: system administrators, developers, hosting teams and the managers who must explain to a board or a regulator what was done. It collects what the PHP project, the disclosing researchers, security vendors and national CERTs have published, and turns it into an order of work.

Publisher

The site is published by SEQ SIA, trading as OffSeq, an offensive security and incident response company (registration number 40203410806, Lastādijas iela 12 k-3, Riga, LV-1050, Latvia). Contact: support@offseq.com.

How the guidance is sourced

• Fixed upstream versions are taken from the PHP project's security advisories on GitHub and the release announcements on php.net. Claims about older affected versions are attributed to whoever made them.
• Technical descriptions follow the PHP advisories first. Where a researcher or vendor adds detail, it is attributed to them by name.
• Claims about exploitation are reported as claims, with the organisation that made them. A vendor saying it saw attack attempts is not the same as a confirmed compromise, and the site keeps the two apart.
• The home page and every guide list their sources at the foot, with links, so you can check a statement before you rely on it.
• The "Updated" date changes only when the text does, and an automated check enforces this.

What the site refuses to do

It publishes no exploit code, no payloads and no step-by-step exploitation detail. Defenders do not need them to patch, and the researchers did not release their exploit code.

The version checker does not scan anything. It reads a version string you paste and compares it with a table of releases. It cannot see whether your distribution backported the fix, which server interface you run, or whether anyone has already been in. Those are questions for a person with access to the server.

Commercial interest

OffSeq sells attack surface management, security audits, incident response and digital forensics. That is a direct interest in you concluding that you need help, and it should colour how you read the calls to action here.

• Links to OffSeq are our own service links, not a market comparison.
• No vendor pays for a mention. Security products named on this site are named because their makers published PHP2Shell guidance, not because of any relationship with us.
• For most organisations the honest answer is that patching PHP and restarting it is the fix, and that you can do it yourself. The site says so.

Corrections

This is a fast-moving disclosure. If something here is wrong or out of date, tell us at support@offseq.com and it will be corrected and re-dated the same day.