About this unofficial PHP2Shell security briefing

Who this is not

• Not the PHP Group, php.net, or the PHP Foundation. Security fixes come from them.
• Not NVD or NIST. NVD pages are linked when a record exists. We do not copy the NVD visual system or imply a NIST score we have not seen.
• Not CISA, ENISA, the UK NCSC, or the Canadian Centre for Cyber Security. Their alerts are sources. This site is not an official notice.
• Not Wiz, Cloudflare, AWS, watchTowr, or any vendor whose research we cite.

Editorial policy

1. Every factual page lists the outbound sources it relies on. If we cannot point at a public page, we do not state the fact.
2. When sources disagree — affected-version floors, the minute of the release, whether an attempt succeeded — we quote the disagreement. We do not invent a compromise figure.
3. We do not host exploit code, proof-of-concept payloads, packet captures of attacks, or procedures for triggering the bugs. Vendor mitigation settings are summarized because the vendor published them as defense.
4. Mechanism sections stay at the level of the vendor advisory: the failure mode and the impact, not a reproduction.
5. English is the primary text. Simplified Chinese pages under /zh/ are translations of the same claims, with hreflang links between them. If the two languages ever diverge, English plus the linked source wins until we correct it.
6. Pages carry a last-updated date. That date is when we revised the page, not the CVE publication date.

Corrections

Send corrections to contact@phpvulnerabilities.app with the page URL, the sentence you dispute, and a primary source. We would rather change a paragraph than defend a tidy story. Security reports about this website itself are welcome at the same address. Please do not send exploit payloads; we will not publish them.

Money

The site is built so it can show Google AdSense units. Until a publisher id is configured, no ad script is requested. Advertising does not change the vulnerability write-ups. The privacy page explains cookies and the missing certified consent platform.