* feat(cli): add experimental --exp-php2shell upgrade-verification probe
Add --exp-php2shell, an experimental CLI-only probe that verifies whether
a PHP server is still reachable by the php2shell crash vector
(CVE-2026-109618). It sends a benign control request and a crafted
multipart request to the target URL, classifies the pair, and reports
detected, not detected, or inconclusive. It reproduces only the first
step of the chain, a brief worker crash from memory exhaustion, and
never attempts the code-execution step.
The probe runs entirely in the CLI with no worker, Temporal, or Docker.
It shows a confirmation prompt before sending, escalates from a smaller
to a full-size probe body, bounds the response it buffers, treats a
timeout or an unhealthy baseline as inconclusive, exits non-zero when the
crash vector is detected, and can write a JSON report with -o.
* docs(php2shell): document the --exp-php2shell probe and its testing
Add the usage reference (docs/exp-php2shell.md) and the test matrix
(docs/exp-php2shell-testing.md), cross-linked, and point the README
banner at both.
ezl-keygraph