php2shell.eu Contact OffSeq

Guides

PHP2Shell guides

Each guide takes one part of the PHP2Shell response and goes through it in full, with the commands, the caveats and the sources.

The set

All guides

  1. Patching PHP2Shell: platform by platform

    Where the fixed PHP packages are for Debian, Ubuntu, RHEL and its rebuilds, Fedora, SUSE, Alpine, Amazon Linux, Docker, control panels and managed hosts, and how to make sure the new binary is the one running.

    Read the guide

  2. PHP2Shell on PHP 8.1, 8.0, 7.x and older

    There is no official fixed release below PHP 8.2. What the PHP project provided for 7.4, 8.0 and 8.1, where distribution fixes come from, and what to do with anything older.

    Read the guide

  3. PHP2Shell mitigations when you cannot patch yet

    The configuration changes the PHP project published for systems that cannot be updated today, what each one blocks, what it breaks, and the two settings that make things worse.

    Read the guide

  4. Was PHP2Shell used against you? Detection and response

    Where to look, what each signal means and does not mean, and what to do if a server shows signs of compromise, including preserving evidence before you rebuild.

    Read the guide

  5. PHP2Shell in the wild: the first 48 hours on a honeypot fleet

    Field data from OffSeq's Mirage decoy fleet: when PHP2Shell traffic started, how many sources sent it, and the indicators defenders can hunt for in their own logs.

    Read the guide

  6. PHP2Shell and your WAF or CDN: what the vendor rules cover

    Which security and cloud vendors published PHP2Shell rules, which are on by default and which you must switch on, and the limits every one of them states.

    Read the guide

  7. PHP2Shell in the EU: CERT advice and reporting duties

    What the EU institutions and national CERTs advised, and when a PHP2Shell incident triggers NIS2, GDPR, DORA, Cyber Resilience Act or Latvian reporting duties.

    Read the guide