Guides for the patch window
6 practical guides. Each one names the official basis, the conditions where it applies, the verification step and the limits. No exploit instructions.
All guides
- Intermediate · System administrators, platform engineers and technical leads
Check whether your PHP2Shell fix is active
A practical verification sequence for the serving runtime: SAPI, package backports, container images, worker restarts and evidence you can keep.
- Advanced · Operations teams who cannot patch immediately
PHP2Shell mitigations and their limits
The official interim PHP settings, why memory_limit=-1 is not safe, and how to verify controls before request parsing.
- Beginner · Developers, editors and decision-makers who read security news
CVE, CVSS, KEV and PoC explained
A practical decoder for PHP2Shell labels: CVSS 9.2 vs 9.8, KEV absence and why a PoC is not proof of exploitation.
- Beginner · Owners of sites on shared, managed or agency-run hosting
What to ask your host about PHP2Shell
A short checklist for hosted sites: get the PHP runtime, patch evidence, restart confirmation and a written answer you can verify.
- Beginner · WordPress site owners, editors and agencies
WordPress vs PHP: where the fix belongs
WordPress, themes and plugins are not the PHP runtime. A practical way to find the host-managed PHP layer and verify the fix.
- Beginner · Managers and business owners coordinating a technical response
PHP2Shell checklist for managers
A decision checklist for managers: scope, owners, fixed services, exceptions and the evidence to ask for without reading exploit details.
They do not provide exploit code, payloads or a way to test a third-party system. They are written for operators verifying their own installations and for readers who need to separate a vendor statement from a media summary.