nelliekeygraph 74c1c933cc feat(cli): add experimental --exp-php2shell upgrade-verification probe (#501) ...

* feat(cli): add experimental --exp-php2shell upgrade-verification probe

Add --exp-php2shell, an experimental CLI-only probe that verifies whether
a PHP server is still reachable by the php2shell crash vector
(CVE-2026-109618). It sends a benign control request and a crafted
multipart request to the target URL, classifies the pair, and reports
detected, not detected, or inconclusive. It reproduces only the first
step of the chain, a brief worker crash from memory exhaustion, and
never attempts the code-execution step.

The probe runs entirely in the CLI with no worker, Temporal, or Docker.
It shows a confirmation prompt before sending, escalates from a smaller
to a full-size probe body, bounds the response it buffers, treats a
timeout or an unhealthy baseline as inconclusive, exits non-zero when the
crash vector is detected, and can write a JSON report with -o.

* docs(php2shell): document the --exp-php2shell probe and its testing

Add the usage reference (docs/exp-php2shell.md) and the test matrix
(docs/exp-php2shell-testing.md), cross-linked, and point the README
banner at both.

2026-10-26 16:17:51 -07:00

..

cli

feat(cli): add experimental --exp-php2shell upgrade-verification probe (#501)

2026-10-26 16:17:51 -07:00

worker

fix(report): pin the cover title spacing to the design

2026-10-07 18:15:36 -07:00