After upgrading PHP for php2shell, you can run an experimental exposure check against a staging server with one command:
npx @keygraph/shannon@3.5.0 start --exp-php2shell -u https://staging.example.comphp2shell is a pair of flaws in the PHP interpreter, disclosed on 21 October. Together they allow unauthenticated remote code execution against any reachable PHP endpoint. Upgrading is the fix: 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Upgrades don't always reach every server, though, and a package pin or an old container image can leave one behind.
The command checks one server. It can make multiple probe attempts designed to crash a PHP worker on an affected release, checks the response and version header, and reports Detected, Not detected, or Inconclusive. It needs no Docker, model key, or source code. It's a scripted probe that ships in the Shannon CLI, separate from a Shannon pentest.
Before you run it:
- Staging only. Authorized use only. Run it only against staging servers you own or have explicit written authorization to test. It is designed to crash a PHP worker on an affected release, so it isn't a read-only check. Do not run it against production.
- It's experimental. It may change or be removed without notice, and it won't get long-term maintenance.
- Not detected has a weak form. With
expose_phpanddisplay_errorsboth off, a crash leaves nothing visible from outside, so runphp -von the server. On Debian, Ubuntu, or RHEL, a backported fix can also show as Detected, so read the distribution's advisory.
The probe stops at the crash check and never attempts the second step of the chain. A Not detected result does not prove that the upgrade landed or that the application is secure. Upgrade whatever it reports.
The verdict table, exit codes, and pipeline setup are in the docs: Verify that your PHP upgrade landed.