diff --git a/CHANGELOG.md b/CHANGELOG.md index bcf8c78..e39b44b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ ## Unreleased +## v2.8.2 — 2026-10-27 + +- Fix: WampServer-style `phpX.Y.Z` install-path version inference (in addition to bare `X.Y.Z`); provenance remains `path_inferred` / MEDIUM — not verified binary metadata and not active-runtime proof. +- Fix: Bounded WampServer Apache (`C:\wamp{,64}\bin\apache\*\conf`) and `C:\wamp64\bin\php\*\php.ini` well-known discovery; reuses existing parsers; config ≠ serving runtime. +- Improve: Executive/CLI/`binary_paths` coverage distinguishes verified, path-inferred, and unknown PHP binary candidates; path-inferred findings require manual verification. +- Fix: Apache handler binary follow-up skips re-inventory when the same path is already recorded (handler config evidence retained). +- Docs: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md); unsigned-binary / endpoint-protection guidance (investigate-first; no broad AV exclusions by default). +- Scope: discovery correctness only — no CVE threshold, telemetry, active-runtime attestation, CISA KEV/Sigma detection imports, or report-schema changes. +- Field: synthetic ASERVER2-style fixture + CI (PR #47 / finalize) PASS; real ASERVER2 host re-scan **NOT YET FIELD-VALIDATED**; interactive Windows PowerShell 5.1 / Windows Terminal ANSI matrix **NOT TESTED**. + ## v2.8.1 — 2026-10-25 - Detection: focused security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 research (research published/covered 22–25 Oct 2026; product release **2026-10-25**). diff --git a/README.md b/README.md index 2ed2375..21eb22a 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ It does **not** exploit systems, execute discovered PHP binaries, upload your da > **Naming:** This project is the **PHP2Shell assessment tool** (a defensive scanner). It assesses advisories such as CVE-2026-109618 / CVE-2026-109619. It is **not** an exploit toolkit and is not affiliated with any similarly nicknamed vulnerability or offensive tooling. -**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** Confirm `php2shell version` matches the binary you run, and verify files against `SHA256SUMS` on the [Releases](https://github.com/Opathedane/php2shell/releases/latest) page. +**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2).** Confirm `php2shell version` matches the binary you run, and verify files against `SHA256SUMS` on the [Releases](https://github.com/Opathedane/php2shell/releases/latest) page. | Advisory | How PHP2Shell treats it | | --- | --- | @@ -32,7 +32,19 @@ It does **not** exploit systems, execute discovered PHP binaries, upload your da | Linux amd64 / arm64 | `php2shell-linux-amd64.tar.gz` / `php2shell-linux-arm64.tar.gz` | | macOS amd64 / arm64 | `php2shell-darwin-amd64.tar.gz` / `php2shell-darwin-arm64.tar.gz` | -Binaries are **not Authenticode-signed**. Always check `SHA256SUMS`. License: [Apache-2.0](LICENSE). +License: [Apache-2.0](LICENSE). + +#### Unsigned binaries and endpoint protection + +PHP2Shell release binaries are currently unsigned. Depending on your organization's security policies, Microsoft Defender, SmartScreen, or other endpoint protection solutions may warn about, block, or quarantine the executable or accompanying deployment scripts. + +Download the tool from the official GitHub release and verify its SHA-256 checksum against the published `SHA256SUMS` file before use. + +If endpoint protection blocks execution, investigate the specific detection first. Where appropriate, an authorized security administrator may approve a narrowly scoped, temporary allow rule for the verified release artifact, preferably using its SHA-256 hash where supported. + +Avoid broad antivirus exclusions for entire directories, PowerShell, executable file extensions, or deployment environments. Do not disable endpoint protection globally. + +Note that checksums provide integrity verification against the published manifest, but do not independently authenticate the publisher. ### 2. Run (interactive — do not use `--quiet` the first time) @@ -65,7 +77,7 @@ Open the newest `php2shell-*.html` in a browser. Start with **Patch assessment** ![Representative HTML report — patch assessment (synthetic lab data)](docs/assets/report-example-patch-assessment.png) -*Representative screenshot only — synthetic lab data (host label `old-php`), not a customer report. Layout remains valid for v2.8.1; CVE thresholds unchanged. Matching HTML: [docs/assets/report-example-patch-assessment.html](docs/assets/report-example-patch-assessment.html).* +*Representative screenshot only — synthetic lab data (host label `old-php`), not a customer report. Layout remains valid for v2.8.2; CVE thresholds unchanged. Matching HTML: [docs/assets/report-example-patch-assessment.html](docs/assets/report-example-patch-assessment.html).* **Automation:** add `--quiet` so progress is suppressed; errors and the status line still go to stderr, and `.status.json` remains machine-readable. @@ -89,19 +101,20 @@ Exit **0 is not a security clearance.** Details: [EXIT-CODES-AND-DEPLOYMENT.md]( --- -## Coverage at a glance (v2.8.1) +## Coverage at a glance (v2.8.2) **Does** - Discover PHP via packages (dpkg/apk), PATH / well-known binaries, IIS/Apache hints, optional `--config-root` / `--deep-root` - Discover **nginx / PHP-FPM configuration** on well-known Unix paths (local / remote / ambiguous FastCGI classification) +- Infer versions from install-path segments (`X.Y.Z` and WampServer-style `phpX.Y.Z`) as **path-inferred / MEDIUM** when binary markers are absent — not verified metadata and not active-runtime proof - Assess observed versions against upstream thresholds; optional IR when you supply logs / telemetry / webroot / WAF exports - Write HTML + CSV + status JSON locally **Does not** - Prove complete PHP discovery on every host layout -- Attest the **active HTTP-serving** PHP runtime or its patch state — including when nginx/FPM configs **correlate** (configuration ≠ verified runtime) +- Attest the **active HTTP-serving** PHP runtime or its patch state — including when nginx/FPM configs **correlate** or path versions are inferred (configuration/path ≠ verified runtime) - Inventory RPM databases or expand Homebrew / custom prefixes in this release - Declare the host clean, safe, or uncompromised @@ -120,7 +133,7 @@ Authoritative coverage contract: [docs/SUPPORTED-COVERAGE.md](docs/SUPPORTED-COV | Advanced usage | [docs/ADVANCED-USAGE.md](docs/ADVANCED-USAGE.md) | | Enterprise (Intune / GPO / collection) | [docs/deployment/](docs/deployment/) | | Security / disclosure | [SECURITY.md](SECURITY.md) | -| Release notes | [docs/RELEASE-NOTES.md](docs/RELEASE-NOTES.md) · [v2.8.1](docs/releases/v2.8.1.md) | +| Release notes | [docs/RELEASE-NOTES.md](docs/RELEASE-NOTES.md) · [v2.8.2](docs/releases/v2.8.2.md) | | Roadmap | [docs/ROADMAP.md](docs/ROADMAP.md) | --- diff --git a/SECURITY.md b/SECURITY.md index 85bfa24..57efe45 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -24,4 +24,4 @@ Do not attach customer HTML reports, access logs, network architecture, credenti ## Supply chain -Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.1`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state. +Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.2`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state. diff --git a/docs/ADVANCED-USAGE.md b/docs/ADVANCED-USAGE.md index 13a0129..ebf0d01 100644 --- a/docs/ADVANCED-USAGE.md +++ b/docs/ADVANCED-USAGE.md @@ -2,13 +2,13 @@ # Advanced usage — PHP2Shell Assessment -Latest public release: **v2.8.1** (security-detection maintenance; nginx/PHP-FPM discovery from v2.8.0 retained). Confirm `php2shell version`. Coverage contract: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md). +Latest public release: **v2.8.2** (WampServer discovery maintenance; nginx/PHP-FPM discovery from v2.8.0 retained). Confirm `php2shell version`. Coverage contract: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md). PHP2Shell does **not** certify that a host is patched or uncompromised. It performs authorized, read-only inventory, evidence-qualified patch review, and offline compromise investigation assist for CVE-2026-109618 / CVE-2026-109619. nginx/FPM configuration correlation never proves the active HTTP-serving runtime or its patch state ([design/nginx-fpm-discovery.md](design/nginx-fpm-discovery.md)). ## Download -Open [Releases](https://github.com/Opathedane/php2shell/releases), choose **v2.8.1**, and download the archive for the destination OS/CPU (use `php2shell-windows-legacy-amd64` only for Server 2012 R2 testing). Binaries are **not code-signed**. Maintainers publish via `.github/workflows/release.yml` after tagging `vX.Y.Z`. Never overwrite existing tags (`v2.3.0`–`v2.8.1`, …). +Open [Releases](https://github.com/Opathedane/php2shell/releases), choose **v2.8.2**, and download the archive for the destination OS/CPU (use `php2shell-windows-legacy-amd64` only for Server 2012 R2 testing). Binaries are **not code-signed**. Maintainers publish via `.github/workflows/release.yml` after tagging `vX.Y.Z`. Never overwrite existing tags (`v2.3.0`–`v2.8.2`, …). ## Scan output pair diff --git a/docs/INSTALL-FOR-CONSULTANTS.md b/docs/INSTALL-FOR-CONSULTANTS.md index a2be8cf..39fd10a 100644 --- a/docs/INSTALL-FOR-CONSULTANTS.md +++ b/docs/INSTALL-FOR-CONSULTANTS.md @@ -1,6 +1,6 @@ # PHP2Shell – consultant quick start -**This tool does not certify a server as patched or uncompromised.** Use it for authorized inventory, evidence-qualified patch review, and offline compromise investigation assist. Latest public release: **v2.8.1**. Confirm `php2shell version` on the binary you run matches the release you downloaded. Platform matrix and honesty limits: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md). +**This tool does not certify a server as patched or uncompromised.** Use it for authorized inventory, evidence-qualified patch review, and offline compromise investigation assist. Latest public release: **v2.8.2**. Confirm `php2shell version` on the binary you run matches the release you downloaded. Platform matrix and honesty limits: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md). Download the build matching the destination OS/CPU from GitHub **Releases** (Windows, Linux, or macOS darwin archives). No Python, Go, PHP, installer, or network access is required for the basic local inventory. The optional IOC update requires an independently authenticated rule signing key and a reviewed signed ruleset; the repository does **not** include a validated PHP2Shell-specific rulepack yet. @@ -64,7 +64,19 @@ Example for a site on `E:`: A configured site path or `.php` files under it is **not** proof of an active patched PHP runtime. Handler config is labelled as configured-only. -Windows executables are **not Authenticode signed** and may generate SmartScreen warnings. Do not bypass endpoint protection. Prefer least privilege. +#### Unsigned binaries and endpoint protection + +PHP2Shell release binaries are currently unsigned. Depending on your organization's security policies, Microsoft Defender, SmartScreen, or other endpoint protection solutions may warn about, block, or quarantine the executable or accompanying deployment scripts. + +Download the tool from the official GitHub release and verify its SHA-256 checksum against the published `SHA256SUMS` file before use. + +If endpoint protection blocks execution, investigate the specific detection first. Where appropriate, an authorized security administrator may approve a narrowly scoped, temporary allow rule for the verified release artifact, preferably using its SHA-256 hash where supported. + +Avoid broad antivirus exclusions for entire directories, PowerShell, executable file extensions, or deployment environments. Do not disable endpoint protection globally. + +Note that checksums provide integrity verification against the published manifest, but do not independently authenticate the publisher. + +Prefer least privilege when running scans. ### When to use Deep Discovery (`--deep-root`) diff --git a/docs/README.md b/docs/README.md index 60ff4ef..b0d1e8c 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,6 +1,6 @@ # PHP2Shell documentation -**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** Start with the [repository README](../README.md) for download and quick start. +**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2).** Start with the [repository README](../README.md) for download and quick start. This index is the map of **current** documentation. Historical release gates, PR drafts, and point-in-time audits remain in-tree for provenance but are not the day-to-day user path. Proposed archive moves (not applied yet): [maintainer/DOCS-ARCHIVE-PLAN.md](maintainer/DOCS-ARCHIVE-PLAN.md). diff --git a/docs/RELEASE-NOTES.md b/docs/RELEASE-NOTES.md index 5af6a15..9fc46dd 100644 --- a/docs/RELEASE-NOTES.md +++ b/docs/RELEASE-NOTES.md @@ -1,11 +1,12 @@ # PHP2Shell release notes -**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)** (25 October 2026). +**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2)** (27 October 2026). Version-specific GitHub Release bodies live under [`docs/releases/`](releases/). The publish workflow uses **only** the matching `docs/releases/vX.Y.Z.md` file — never this index. | Version | Notes | | --- | --- | +| [v2.8.2](releases/v2.8.2.md) | WampServer discovery maintenance (`phpX.Y.Z` path inference, bounded Apache/php.ini roots, verified vs inferred reporting; no threshold/telemetry/schema changes) | | [v2.8.1](releases/v2.8.1.md) | Focused security-detection maintenance (ReliaQuest + Unit 42; conservative confidence; research dates ≠ release date; no discovery/threshold changes) | | [v2.8.0](releases/v2.8.0.md) | Bounded nginx/PHP-FPM config discovery (config ≠ verified runtime/patch; no new CTI/IOC; thresholds unchanged) | | [v2.7.5](releases/v2.7.5.md) | Unix PHP symlink discovery (patch; no new CTI/IOC; thresholds unchanged) | diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 3e0c0b5..d38f8d0 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -1,13 +1,20 @@ # PHP2Shell roadmap -**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)** (security-detection maintenance). Notes: [releases/v2.8.1.md](releases/v2.8.1.md). +**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2)** (WampServer discovery maintenance). Notes: [releases/v2.8.2.md](releases/v2.8.2.md). -This file lists **open** product directions. It is not a commitment calendar. Honesty rules stay fixed: installed ≠ configured ≠ actively serving; config never attests patch posture of the live HTTP SAPI. +This file lists **open** product directions. It is not a commitment calendar. Honesty rules stay fixed: installed ≠ configured ≠ actively serving; config never attests patch posture of the live HTTP SAPI. Path-inferred directory versions remain MEDIUM-confidence inventory leads — not verified binary metadata and not active-runtime proof. -**Maintenance mode:** after v2.8.1, no additional development is planned without new security intelligence, confirmed defects, or demonstrated user demand. +**Maintenance mode:** after v2.8.2, no additional development is planned without new security intelligence, confirmed defects, or demonstrated user demand. ## Shipped recently +### v2.8.2 + +- WampServer-style `phpX.Y.Z` path inference (path_inferred / MEDIUM) +- Bounded Wamp Apache / wamp64 php.ini discovery; multi-source binary dedup +- Clearer verified vs path-inferred vs unknown coverage messaging +- No threshold / telemetry / active-runtime attestation / schema changes + ### v2.8.1 - ReliaQuest-aligned error patterns (`zend_mm_heap`, AH00052 Abort) + multi-signal correlation @@ -57,6 +64,14 @@ Read-only RPM DB inventory (no `rpm`/`dnf` subprocess) with careful NEVRA handli Richer binding across FPM / reverse-proxy layouts **without** claiming active-SAPI attestation from configuration alone. Homebrew / custom-prefix expansion remains a separate, bounded design problem. +### Detection / investigation (deferred — not in v2.8.2) + +Candidates for a **future maintenance decision only** (source-integrity and false-positive review required before any adoption): + +- CISA KEV catalog awareness / documentation (CVE-2026-109618 / CVE-2026-109619 added **26 Oct 2026**) +- Selective evaluation of CISA TLP:CLEAR Sigma hunting keywords vs existing IR patterns (PoC markers, multipart/body signals, infrastructure IOCs) — many are unsuitable for default offline scanner rules without high FP risk +- Additional Unit 42 / public research signals not already covered in v2.8.1 + ### Explicitly not near-term product goals - Docker/container runtime inventory as a product feature diff --git a/docs/SUPPORTED-COVERAGE.md b/docs/SUPPORTED-COVERAGE.md index 4a4da19..4f1ee0c 100644 --- a/docs/SUPPORTED-COVERAGE.md +++ b/docs/SUPPORTED-COVERAGE.md @@ -1,6 +1,6 @@ # Supported platforms and scan coverage -**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** +**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2).** This page is the short coverage contract. Details and flags: [ADVANCED-USAGE.md](ADVANCED-USAGE.md). Report reading: [UNDERSTANDING-REPORTS.md](UNDERSTANDING-REPORTS.md). diff --git a/docs/THREAT-INTELLIGENCE.md b/docs/THREAT-INTELLIGENCE.md index 18291e0..d4e04c7 100644 --- a/docs/THREAT-INTELLIGENCE.md +++ b/docs/THREAT-INTELLIGENCE.md @@ -22,6 +22,7 @@ - Compromise investigation assist: offline access/error-log review, offline process/EDR telemetry (`--process-telemetry`: MDE, Sysmon, auditd, Elastic ECS), passive webroot metadata investigation, independent statuses, research-backed PHP/Apache error patterns and web/PHP process-relationship leads. See [COMPROMISE-INVESTIGATION.md](COMPROMISE-INVESTIGATION.md) and [releases/v2.7.0.md](releases/v2.7.0.md). - **v2.8.1** (published 25 October 2026): security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 (**research published/covered 22–25 Oct 2026**; product release date independent). ReliaQuest multi-signal sequences (`zend_mm_heap`, AH00052 Abort, OOM Unknown on line 0), POST 5xx correlation-only assist, Unit 42 agentic delimiters, conservative confidence ladder. Does **not** claim every published technique (body markers, LDAP inventories, same-request identity without PID). Notes: [releases/v2.8.1.md](releases/v2.8.1.md). +- **v2.8.2** (published 27 October 2026): discovery correctness only (WampServer path inference / bounded config roots). **No** new detection rules. CISA KEV listing (26 Oct 2026) and CISA TLP:CLEAR Sigma hunting content are **deferred** for a future maintenance decision after source-integrity / false-positive review — not imported into the scanner. Notes: [releases/v2.8.2.md](releases/v2.8.2.md). - AWS MadPot source IPs remain **weak** threat-intelligence candidates only; not imported as proof of exploitation or compromise. ## Planned validated features (not delivered) diff --git a/docs/UNDERSTANDING-REPORTS.md b/docs/UNDERSTANDING-REPORTS.md index 3f4147a..5a2af7f 100644 --- a/docs/UNDERSTANDING-REPORTS.md +++ b/docs/UNDERSTANDING-REPORTS.md @@ -4,7 +4,7 @@ This guide is for IT administrators reading an HTML report or CSV fleet row for PHP2Shell assesses **observed PHP inventory** against official upstream advisories. A successful scan is **not** proof that the HTTP-serving runtime is patched or that the host is uncompromised. -**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** +**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2).** **Primary CVEs:** CVE-2026-109618, CVE-2026-109619 **Upstream fix thresholds (21 Oct 2026):** PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 **Additional advisory:** CVE-2026-115560 (informational; no fixed versions yet) @@ -13,6 +13,8 @@ Synthetic screenshot + HTML (no customer data): [`assets/report-example-patch-as **nginx / PHP-FPM (v2.8.0):** configuration evidence may appear under technical / coverage sections. Correlation of `fastcgi_pass` with a local FPM `listen` is **never** proof of the active HTTP-serving PHP runtime or its patch state. See [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md). +**Path-inferred versions (incl. WampServer `phpX.Y.Z` directories):** when a binary lacks embedded/PE version markers, PHP2Shell may infer `x.y.z` from the install path. That evidence is **`path_inferred` / MEDIUM** — not verified binary metadata, not a confirmed installation certificate, and not proof of the active HTTP-serving runtime. Prefer verified binary metadata when present; treat path-inferred rows as leads requiring manual verification. + --- ## 1. How to read the HTML (first screen) diff --git a/docs/assets/README.md b/docs/assets/README.md index 2de0687..866dbd0 100644 --- a/docs/assets/README.md +++ b/docs/assets/README.md @@ -7,6 +7,6 @@ Files here are **long-lived** README / docs illustrations. Prefer this directory | `report-example-patch-assessment.png` | README example HTML executive summary (synthetic) | | `report-example-patch-assessment.html` | Matching HTML sample for offline viewing | -**Anonymization / representativeness:** Synthetic lab fixture only — **not** a customer report. Host label is a non-customer lab name (`old-php`). No customer hostnames, paths, or engagement data. Generated from project UX test fixtures; report layout remains **representative** for v2.8.1 (CVE thresholds unchanged). +**Anonymization / representativeness:** Synthetic lab fixture only — **not** a customer report. Host label is a non-customer lab name (`old-php`). No customer hostnames, paths, or engagement data. Generated from project UX test fixtures; report layout remains **representative** for v2.8.2 (CVE thresholds unchanged). Do not commit real customer reports here. diff --git a/docs/releases/v2.8.2.md b/docs/releases/v2.8.2.md new file mode 100644 index 0000000..2a28a5c --- /dev/null +++ b/docs/releases/v2.8.2.md @@ -0,0 +1,88 @@ +# PHP2Shell v2.8.2 + +Published: **27 October 2026** +Tag: [`v2.8.2`](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2) + +Focused **discovery correctness maintenance** for confirmed WampServer inventory gaps reported against v2.8.1. Preserves CVE vulnerability thresholds, investigation/telemetry behaviour, active-runtime attestation limits, exit codes, HTML/CSV/status JSON, fleet CSV **v3**, and report schemas. Does **not** overwrite `v2.8.1` (or earlier) release assets. Offline and read-only by default. No active exploitation, network probing, broad filesystem scanning, PHP binary execution, or unrelated discovery expansion. + +**Field validation:** Automated unit/regression and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green on the discovery merge (PR #47 tip `75b077b` / merge `bf70ade`) and this finalize tip. **Synthetic** ASERVER2-style WampServer fixture regressions PASS. **Real-world ASERVER2 host re-scan** remains **NOT YET FIELD-VALIDATED** for this release — do not treat the synthetic fixture as a substitute. Interactive **Windows PowerShell 5.1** and **Windows Terminal** ANSI/colour matrix remains **NOT TESTED** (outstanding from earlier releases). Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing. + +## Downloads + +- `php2shell-windows-amd64.zip` — Windows 10 / Server 2016+ (primary Go toolchain) +- `php2shell-windows-legacy-amd64.zip` — **Go 1.20.14** build for Windows Server 2012 R2 testing (see limitations below) +- `php2shell-linux-amd64.tar.gz` / `php2shell-linux-arm64.tar.gz` +- `php2shell-darwin-amd64.tar.gz` / `php2shell-darwin-arm64.tar.gz` (developer convenience) + +Verify `SHA256SUMS`. Binaries are **not code-signed**. Confirm `php2shell version` prints `2.8.2` (and `(legacy)` for the legacy Windows EXE). License: **Apache License 2.0**. See README / consultant install guide for unsigned-binary and endpoint-protection guidance (investigate detections first; no broad AV exclusions by default). + +## What is new + +### WampServer-style PHP version path inference + +- Directory segments formatted as `phpX.Y.Z` (e.g. `C:\wamp64\bin\php\php7.4.33\php.exe`) are recognized in addition to bare `X.Y.Z` +- Inferred versions remain **`binary_path_inferred_version`** with provenance **`path_inferred`** and confidence **`MEDIUM`** +- Path-inferred versions are **not** verified binary metadata and are **not** proof of the active HTTP-serving runtime +- Marker-free binaries under these layouts can receive legacy/EOL patch review messaging when a comparable version is inferred — still requiring manual verification + +### Bounded WampServer configuration discovery + +- Apache config roots expanded with bounded globs: `C:\wamp64\bin\apache\*\conf`, `C:\wamp\bin\apache\*\conf` (`filepath.Glob` only; not recursive host-wide scanning) +- Well-known php.ini patterns include `C:\wamp64\bin\php\*\php.ini` (alongside existing `C:\wamp\...`) +- Reuses existing Apache / php.ini parsers and coverage semantics +- Static configuration alone still does **not** verify an active web-serving PHP runtime + +### Clearer verified / inferred / unknown reporting + +- Executive HTML, CLI summary, and `binary_paths` coverage distinguish: + - verified binary metadata versions + - path-inferred versions (MEDIUM; manual verification required) + - candidates without comparable versions +- Path-inferred findings are not presented as confirmed installations or proven vulnerability exposure + +### Deduplication across discovery sources + +- Apache handler binary follow-up skips re-inventory when the same PHP binary path is already recorded (e.g. well-known / PATH discovery) +- Handler/module configuration evidence is still recorded +- Install grouping and patch assessment stay one logical install tree / one row per distinct binary path + +## Honesty (required reading) + +| Observation | Means | +| --- | --- | +| Verified binary metadata | Text extracted from embedded/PE markers — still **not** proof the binary serves HTTP | +| Path-inferred (`phpX.Y.Z` / bare `X.Y.Z`) | Directory-derived inventory lead — **MEDIUM** confidence; requires manual verification | +| Apache / php.ini candidates | Configured paths only — **not** active runtime or effective settings attestation | +| Active web runtime | Remains unverified unless separately established; inventory never upgrades to “Verified” from path/config alone | + +## Explicitly out of scope for v2.8.2 + +- Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) +- New telemetry sources, investigation axes, CTI/IOC packs, or CISA KEV / Sigma-rule detection imports +- Active HTTP SAPI attestation (`NOT_IMPLEMENTED` unchanged) +- Report schema / exit-code / fleet CSV contract changes +- Broad recursive filesystem scanning or executing PHP binaries +- Unrelated well-known path expansion beyond the bounded WampServer roots above +- Authenticode signing (still unsigned + `SHA256SUMS`) + +## Preserved from v2.8.1 + +- ReliaQuest / Unit 42–aligned investigation assists and confidence ladder +- Bounded nginx / PHP-FPM configuration discovery; Unix PHP symlink discovery; console UX; enterprise quiet/status JSON; legacy Windows artifact; Apache-2.0 + +## Limitations (read before deploying) + +- Process completion / exit **0** is **not** a vulnerability or compromise clearance +- Path-inferred versions are inventory leads, not confirmed installs or proven exposure +- Missing evidence is **not** a negative finding; absence of PHP findings is **not** proof a host is PHP-free +- Active HTTP-serving SAPI is still **not** attested from path inference or Apache/php.ini inventory +- Custom drive letters / nonstandard Wamp layouts still need `--config-root` / `--deep-root` / `--php-ini` +- Vendor backports require separate verification +- Binaries remain **unsigned**; verify `SHA256SUMS` (integrity vs published manifest, not independent publisher authentication) +- Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains **NOT TESTED** +- Real ASERVER2 host validation after this publish remains an operator follow-up + +## See also + +- Prior: [v2.8.1](v2.8.1.md) · [v2.8.0](v2.8.0.md) +- Understanding reports: [UNDERSTANDING-REPORTS.md](../UNDERSTANDING-REPORTS.md) diff --git a/internal/audit/model.go b/internal/audit/model.go index 700841e..9a57c62 100644 --- a/internal/audit/model.go +++ b/internal/audit/model.go @@ -6,7 +6,7 @@ import ( ) const Schema = "php2shell-assessment/v1" -const Version = "2.8.1" +const Version = "2.8.2" type Evidence struct { Type string `json:"type"`