About PHP2Shell.help: who runs it, how it decides and how it's funded

Why does PHP2Shell.help exist?

Official advisories are written for PHP developers and server operators. Most people responsible for a website need something simpler: is my site affected, and what exactly do I do? We answer those questions in plain language, for people with and without server access, and keep the answers in step with the official sources.

How does the PHP2Shell checker decide?

From the PHP version and setup you enter, compared with the first fixed release for each branch and with published vendor package versions. Nothing else.

• There are four possible verdicts: in the affected range, matches a fixed release, check your vendor’s patch and can’t tell yet.
• The checker runs in your browser. It never contacts your server, scans sites or runs exploits.
• A temporary mitigation or a WAF never turns a verdict into “fixed”.
• A command-line result is marked as not confirming what your website runs.
• No verdict says whether a site was hacked in the past.

Try it on the PHP2Shell checker or the PHP version checker.

Which sources does PHP2Shell.help use?

Official sources first: PHP’s security announcement and the two GitHub security advisories, then operating-system vendors, hosting providers and national cybersecurity agencies, then the original research. Each page lists its sources and the date we checked them. Claims we couldn’t verify are marked as unverified, never filled in by guesswork. Changes are recorded on the changelog.

How is PHP2Shell.help funded?

It is currently a volunteer project with no advertising and no partner links. If we add funding later, such as clearly labelled partner links, vetted service referrals or donations, these rules apply:

• Partner links are labelled as partner links on every page where they appear.
• We only recommend hosts we have verified have installed the PHP2Shell fix, and we show the date we checked.
• Partner content never appears inside checker results, and no income source affects a verdict or a fix recommendation.
• We never use alarming language to push you towards a partner.

We use Google Analytics to count visits; see privacy.

Is PHP2Shell.help official?

No. It’s an independent community resource. For authoritative statements, follow the links to The PHP Group, your operating-system vendor and your national cybersecurity agency.

How do I report a mistake?

Tell us the page, what’s wrong and a link to your source. We correct facts quickly and note the correction on the changelog. Email support@php2shell.help.