Skip to content
php2shell.eu
  • Check your version
  • In the wild
  • Response plan
  • Mitigations
  • Detection
  • Guides
Contact OffSeq→
Home

Privacy policy

Updated 21 October 2026

Operator and scope

php2shell.eu is a free reference operated by SEQ SIA (OffSeq), registration number 40203410806, Lastādijas iela 12 k-3, Riga, LV-1050, Latvia. The site has no user accounts, no newsletter, no contact form and no comments.

The version checker

The checker runs entirely in your browser. The version string you paste and the server type you select are compared against a fixed table of PHP releases inside the page. They are not sent to OffSeq or anyone else, not written to local storage or any cookie, not included in analytics events, and not added to outbound links. Closing or reloading the page discards them. The checker never contacts, scans or probes your server: it only reads the text you give it.

Technical requests and traffic measurement

Serving a page through Cloudflare involves technical request data, including an IP address, browser headers, the requested URL and the request time. These data support delivery, security and operation of the site. Cloudflare may set its own security cookies; those are separate from the site application.

The site sends page views and clicks on OffSeq service and contact links to our self-hosted Plausible service at in.ainalytic.net. Events include the site domain, the public page address, limited campaign parameters and the referring site's origin when available. A link-click event adds only a static destination path and a placement label such as header, hero or checker. Version strings and checker results are never sent. The application does not set analytics cookies or a persistent visitor identifier; the collector receives technical network information with the request. Cookieless measurement is still data processing.

Measurement is disabled when the browser signals Do Not Track or Global Privacy Control, when the local-storage preference plausible_ignore is set to true, and for previews, local development and recognised automation. OffSeq links may carry static referral labels identifying this resource and the link placement; those labels never contain anything you typed into the checker.

Purpose, legal basis and retention

We use technical request data to operate and secure the site, and page-view and link-click statistics to understand how the resource is used and how much interest there is in OffSeq services. Our legal basis for these purposes is legitimate interests under Article 6(1)(f) GDPR. Hosting and infrastructure providers process requests on our behalf; the analytics service is self-hosted. Data are kept only as long as needed for those purposes and any applicable legal obligation. The operator's privacy policy explains its retention criteria, providers and transfer safeguards.

Contact and external links

If you email support@offseq.com, we receive the address, the message and anything you choose to include, so that we can reply. Please do not send incident evidence, logs or credentials to that address; it is a general enquiry mailbox, not a secure intake. The OffSeq contact page publishes an OpenPGP key for encrypted material. Correspondence is retained while it is needed to handle the enquiry or the business relationship. OffSeq service links and the advisories cited on this site take you to sites with their own privacy notices.

Your rights

Subject to the conditions in the GDPR, you may request access, correction, deletion, restriction or portability, and object to processing. Contact support@offseq.com. You may also complain to Latvia's Data State Inspectorate or to the supervisory authority where you live or work. The cookie and browser-storage notice covers what is and is not stored in your browser.

php2shell.eu

php2shell.eu is a free response guide to the PHP2Shell vulnerabilities, written for the people who have to patch, check and explain. Every version number and recommendation here is cited to the PHP project, the researchers, a security vendor or a named national CERT, so you can check it.

Guides

  • Patch by platform
  • End-of-life PHP
  • Mitigations
  • Detection and response
  • In the wild: first 48 hours
  • WAF and CDN rules
  • EU advice and reporting

Professional help

  • PHP2Shell field research
  • Incident response and forensics
  • Attack surface management
  • Security audits
  • Talk to OffSeq

Information

  • About
  • Privacy policy
  • Cookies and browser storage

php2shell.eu is maintained by the OffSeq security team. It is not affiliated with the PHP project, the PHP Foundation or any of the research teams that disclosed these vulnerabilities.

The guidance here summarises public advisories as they stood on the date shown. It is not a substitute for the PHP security advisories or your vendor's own notices, and it cannot tell you whether a particular server has been compromised.

Operated by SEQ SIA · Riga, Latvia