Guides for the patch window
6 practical guides. Each one names the official basis, the conditions where it applies, the verification step and the limits. No exploit instructions.
All guides
- Intermediate · System administrators, platform engineers and technical leads
Check whether your PHP2Shell fix is active
A practical verification sequence for the serving runtime: SAPI, package backports, container images, worker restarts and evidence you can keep.
- Advanced · Operations teams who cannot patch immediately
PHP2Shell mitigations and their limits
The official interim settings, why memory_limit=-1 is not a safety switch, how to apply configuration before request parsing, and how to verify it took effect.
- Beginner · Developers, editors and decision-makers who read security news
CVE, CVSS, KEV and PoC explained
A practical decoder for the labels around PHP2Shell, including why a CVSS 9.2 and a CVSS 9.8 can describe the same CVE and why KEV absence is not a clean bill of health.
- Beginner · Owners of sites on shared, managed or agency-run hosting
What to ask your hosting provider about PHP2Shell
A short checklist for hosted sites: get the PHP runtime, patch evidence, restart confirmation and a written answer you can verify.
- Beginner · WordPress site owners, editors and agencies
WordPress vs PHP: where the PHP2Shell fix belongs
WordPress, themes and plugins are not the PHP runtime. A practical way to find the host-managed PHP layer and verify the fix.
- Beginner · Managers and business owners coordinating a technical response
PHP2Shell response checklist for non-technical leads
A decision checklist for managers: scope, owners, fixed services, exceptions and the evidence to ask for without reading exploit details.
They do not provide exploit code, payloads or a way to test a third-party system. They are written for operators verifying their own installations and for readers who need to separate a vendor statement from a media summary.