php2shell

package

v0.2.1 Latest Latest Go to latest Published: Oct 22, 2026 License: BSD-3-Clause Imports: 22 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DefectDojo/earlylight

Links

Open Source Insights

Documentation ¶

Overview ¶

Package php2shell is the detector for CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), the two remote code execution flaws in the PHP engine fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, 2026. It finds PHP runtimes in filesystems and container images and judges each by upstream release and by its vendor's backport data, and it checks the images a source tree builds on and deploys.

The detection lives in internal/, copied verbatim from php2shell-scan (see SNAPSHOT at the repo root), and verbatim.go holds the parts of its command line the engine needs. This file only adapts them to the engine and replays php2shell-scan's per-target collector, so verdicts stay identical.

Constants ¶

View Source

const (
	KindRuntimeWeb = "php-runtime-web"
	KindRuntimeCLI = "php-runtime-cli"
	KindImage      = "php-image"
)

Kind IDs. Runtimes that serve web requests and those that do not are separate kinds because they carry different severities.

View Source

const ID = "php2shell"

ID is the detector's ID.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Detector ¶

type Detector struct {
	// contains filtered or unexported fields
}

Detector implements engine.Detector, engine.Reader, engine.RepoScanner and engine.Fixer.

func (*Detector) Fix ¶

func (d *Detector) Fix(ctx context.Context, dirs []string, o engine.Options, stdout, stderr io.Writer) int

Fix moves a source tree's vulnerable PHP image references to published fixed images, as php2shell-scan fix does.

func (*Detector) Load ¶

func (d *Detector) Load() error

Load loads the distribution fix data, which refuses to load if it contradicts itself.

func (*Detector) Manifest ¶

func (d *Detector) Manifest() engine.Manifest

Manifest describes the detector.

func (*Detector) NewScan ¶

func (d *Detector) NewScan(kind engine.TargetKind) engine.Scan

NewScan starts a filesystem or image scan.

func (*Detector) ScanRepo ¶

func (d *Detector) ScanRepo(ctx context.Context, dir string, o engine.Options) *engine.Target

ScanRepo checks the images a source tree builds on and deploys.

func (*Detector) Wants ¶

func (d *Detector) Wants(p string, head []byte, _ bool) bool

Wants reads executables (possible PHP runtimes) and package-database files. The executable test is php2shell-scan's own, which tells Java class files from Mach-O universal binaries.

Source Files ¶

View all Source files

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
internal
assess Package assess decides, for each PHP runtime found, whether it is vulnerable to CVE-2026-109618 and CVE-2026-109619, fixed, or unknown, and why.	Package assess decides, for each PHP runtime found, whether it is vulnerable to CVE-2026-109618 and CVE-2026-109619, fixed, or unknown, and why.
detect Package detect recognises PHP runtimes (the CLI, PHP-FPM, CGI, the Apache module, LiteSpeed, FrankenPHP and embedded builds) by content, not by name, and reads the version each one was built as.	Package detect recognises PHP runtimes (the CLI, PHP-FPM, CGI, the Apache module, LiteSpeed, FrankenPHP and embedded builds) by content, not by name, and reads the version each one was built as.
fix Package fix proposes and applies deterministic one-line fixes for image references that carry a PHP release vulnerable to CVE-2026-109618 and CVE-2026-109619.	Package fix proposes and applies deterministic one-line fixes for image references that carry a PHP release vulnerable to CVE-2026-109618 and CVE-2026-109619.
image Package image opens a container image and yields its final filesystem.	Package image opens a container image and yields its final filesystem.
knowledge Package knowledge holds everything the scanner knows about CVE-2026-109618 and CVE-2026-109619: the upstream releases that fix them and, per distribution, the package versions that fix them or are known to be vulnerable.	Package knowledge holds everything the scanner knows about CVE-2026-109618 and CVE-2026-109619: the upstream releases that fix them and, per distribution, the package versions that fix them or are known to be vulnerable.
netguard Package netguard is the HTTP transport for registry lookups.	Package netguard is the HTTP transport for registry lookups.
pkgdb Package pkgdb reads the package databases a system or container image carries (dpkg, apk, rpm) and answers which installed package owns a file, so a PHP binary installed by a distribution is judged by that distribution's fix and not by its upstream version string.	Package pkgdb reads the package databases a system or container image carries (dpkg, apk, rpm) and answers which installed package owns a file, so a PHP binary installed by a distribution is judged by that distribution's fix and not by its upstream version string.
pkgdb/rpmdb Package rpmdb lets pkgdb read rpm sqlite databases (rpmdb.sqlite, rpm 4.16 and later: RHEL 9, Fedora 33+, Amazon Linux 2023, SLES 16).	Package rpmdb lets pkgdb read rpm sqlite databases (rpmdb.sqlite, rpm 4.16 and later: RHEL 9, Fedora 33+, Amazon Linux 2023, SLES 16).
refs Package refs finds container image references in a source repository: Dockerfiles and Containerfiles, Compose files, Kubernetes, OpenShift and Knative manifests (including rendered Helm output), Helm values files, and CI configuration (GitHub Actions, GitLab CI, Bitbucket Pipelines).	Package refs finds container image references in a source repository: Dockerfiles and Containerfiles, Compose files, Kubernetes, OpenShift and Knative manifests (including rendered Helm output), Helm values files, and CI configuration (GitHub Actions, GitLab CI, Bitbucket Pipelines).
registry Package registry resolves image references against their registries and decides, from image configuration alone, which PHP release each platform of an image carries.	Package registry resolves image references against their registries and decides, from image configuration alone, which PHP release each platform of an image carries.
registry/registrytest Package registrytest runs an in-memory OCI registry for tests and builds images that look like the official php image and images derived from it.	Package registrytest runs an in-memory OCI registry for tests and builds images that look like the official php image and images derived from it.
repocheck Package repocheck judges the image references found in a repository: it resolves each one (once per distinct reference) and assesses it with registry.Assess.	Package repocheck judges the image references found in a repository: it resolves each one (once per distinct reference) and assesses it with registry.Assess.
report Package report renders scan results as text, JSON or SARIF.	Package report renders scan results as text, JSON or SARIF.
reposcan Package reposcan checks the image references in a source tree and plans the fix for each vulnerable one.	Package reposcan checks the image references in a source tree and plans the fix for each vulnerable one.
source Package source feeds files to the scanner from a directory tree or a container image's flattened filesystem, and records every file it could not read so a scan never claims coverage it did not have.	Package source feeds files to the scanner from a directory tree or a container image's flattened filesystem, and records every file it could not read so a scan never claims coverage it did not have.
version Package version parses PHP release versions and compares distribution package versions with each package manager's own rules (dpkg, apk, rpm).	Package version parses PHP release versions and compares distribution package versions with each package manager's own rules (dpkg, apk, rpm).