Nellie Mullane 2dc3a88e27 feat(cli): add experimental --exp-php2shell upgrade-verification probe ...

Add --exp-php2shell, an experimental CLI-only probe that verifies whether
a PHP server is still reachable by the php2shell crash vector
(CVE-2026-109618). It sends a benign control request and a crafted
multipart request to the target URL, classifies the pair, and reports
detected, not detected, or inconclusive. It reproduces only the first
step of the chain, a brief worker crash from memory exhaustion, and
never attempts the code-execution step.

The probe runs entirely in the CLI with no worker, Temporal, or Docker.
It shows a confirmation prompt before sending, escalates from a smaller
to a full-size probe body, bounds the response it buffers, treats a
timeout or an unhealthy baseline as inconclusive, exits non-zero when the
crash vector is detected, and can write a JSON report with -o.

2026-10-26 16:01:45 -07:00

..

cli

feat(cli): add experimental --exp-php2shell upgrade-verification probe

2026-10-26 16:01:45 -07:00

worker

fix(report): pin the cover title spacing to the design

2026-10-07 18:15:36 -07:00