Developer: the run of 2026-10-23T2357Z

The review, in the reader's words

The technical core is still the best write-up of php2shell I have read, but fifteen releases on, the one thing I came to do, prove my Docker images are patched, still gets a single php -v line, and the pages I read now lag the site's own newer data.

Got the answer partly · The bug, the fixed versions and 'your code cannot fix it' landed in the thirty-second answer on briefings/developer/index.html (page 2); SAPIs, version table and mitigations on flaws/index.html (page 3); what the fix changes on code/index.html (page 4). How to verify an image or a distro backport never went beyond 'php -v inside the container', on any of the eight pages or in llms.txt.

What works

• The thirty-second answer still does the right job for a developer: the flaw is in the C engine, ini_set, .user.ini and auto_prepend_file run too late, check the running version after the restart. It stops me wasting time on code-side fixes. (briefings/developer/index.html)
• Each CVE has its GHSA ID, full CVSS 4.0 vector, CWEs, exact timestamps and the record's description verbatim, kept apart from what was demonstrated and what the fix does. (flaws/index.html)
• The SAPI table shows the FPM disagreement between the GitHub advisory and the Foundation instead of smoothing it over, and says CLI parsing untrusted input is 'not covered either way by the primary sources'. That is the honesty I want. (flaws/index.html)
• The warning that the CVE records default to 'unaffected' and list only 8.2 to 8.5, so scanners will clear 7.4 to 8.1. Still the most practically useful sentence for anyone with a scanner in CI. (flaws/index.html)
• The mitigations table puts each setting beside its own caveat and where it must be set (php_admin_value, pool, php.ini), including the RLIMIT_AS warning and pm.max_requests=1. (flaws/index.html)
• Full commit hash, parent, authors, merge times into each branch, a step-by-step before and after, readable C hunks, and the 7.4 backport's different _exit strategy with its 17 files listed. I can go and diff this myself. (code/index.html)
• 'What the fix changes' warns about the delayed OOM, memory_hard_limit_percent and max_multipart_body_parts. That is what I need to warn QA about. (patching/index.html)
• The review page states the code layer comes from git show -U0 by a parser, never a model, with per-file added and removed counts. A provenance claim I can check. (review/index.html)
• status.json now carries the CVE IDs, data_as_of and the vault commit, so a tool can at least tell how fresh it is; the flaws markdown twin still renders clean tables and a backticked CVSS vector. (status.json)

What does not

• high There is still no real verification step for container images or backports: one sentence about php -v, no docker run command, no version-independent check, nothing for distro builds. (briefings/developer/index.html)
  The only instruction is still 'Check the running version where the code runs: php -v inside the container or phpinfo() on the box, after the restart. The package list is not the answer.' llms.txt's am-i-affected answer adds 'without a distribution backport' but never says how to tell.
• high php -v gives the wrong answer on the backports the site itself marks fixed: an Ubuntu Noble box reports 8.3.6, below 8.3.36. (patching/index.html)
  'fixed Canonical / Ubuntu package maintainers: Ubuntu Noble php8.3-fpm binary package 8.3.6-0ubuntu0.24.04.13' against the briefing's 'Fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35'. Same for Jammy 8.1.2 and Focal 7.4.3.
• high The Docker Official Image row, the one I most need, still has no tags, versions, rebuild date or digests. (patching/index.html)
  'fixed Docker Official Images maintainers: Docker Official Image: php' with no version text, on the ladder and again under 'Fixed, but you must rebuild and redeploy', while Debian, Red Hat, Heroku and Bref rows carry versions.
• medium The patching and affected pages are frozen at an old inventory commit while the site says it has read a much newer one, so I do not know which figures to cite. (patching/index.html)
  patching/index.html: '46 fixed · 206 still affected · 418 under investigation · 3 not affected, of 674 products ... at commit cca173c64ec5 (22 October, 08:40 UTC)'. The front page says 'the NCSC-NL inventory, latest change read 23 October 2026, 12:50 UTC'; admin/versions.html v0.10.4 says '109 of 751 products fixed'; v0.4.3's correction 'had 675 rows at the captured commit, not 674' is still not applied on patching, affected or llms.txt.
• medium The 'still open' lists say PHP has not answered the incomplete-fix report, but the site's own release notes say it did, on 22 October. (index.html)
  index.html: 'Whether the fix is complete. A report on 21 October suggested it may not be; the PHP project has not answered it publicly yet.' briefings/developer/index.html: 'Nothing from PHP on the list yet.' admin/versions.html v0.5.8: 'the PHP security team answered the 'incomplete fix' report publicly at 09:11 UTC on 22 October ... so the front page's 'not answered publicly yet' is out of date'.
• medium status.json still has no machine-readable affected ranges or fixed versions and does not link data/affected.json, so a CI step cannot gate on it. (status.json)
  Versions appear only in prose in headline_facts[0].text; links holds front, sources, claims, stories, releases, llms and nothing for affected or patching.
• medium The SAPI table still has no row for long-running workers (Octane on Swoole or RoadRunner), where cross-request stale state should worry a Laravel team most. (flaws/index.html)
  SAPI rows: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed (LSAPI), CLI/cron/queue workers. Nothing for Swoole or RoadRunner, not even 'not covered'.
• medium The cPanel row under 8.1, 8.0 and 7.4 still lists only 8.2 to 8.4 packages, and the page's prose now contradicts the row. (patching/index.html)
  Row: 'cPanel EasyApache 4 / MultiPHP EA4 25.91: ea-php82 8.2.35; ea-php83 8.3.36; ea-php84 8.4.27'. Prose: 'cPanel backported to 7.4, 8.0 and 8.1'.
• low The hunks are still called verbatim but contain elisions, and the code block has no diff colouring, so the removed bailout and the added lines look the same in dark mode. (code/index.html)
  'the hunks below are verbatim' followed by 'bool *did_gc ...)', '{ ... }' and bare '...' lines; the block is a plain <pre> with no add or delete classes, and full.jpg shows uniform white monospace.
• low The commit hash links to the site's own source page, not to the upstream php-src commit. (code/index.html)
  The only link for 3584a98 is '../sources/github-php-src-fix-commit-3584a98bd/index.html'.
• low Downstream rows are still cut off mid-word. (patching/index.html)
  'Bref 3: php-85:21, php-84:24, php-83:24, php-82:26; Bref 2 l', 'Cloud Run customer containers with unpatched PHP on their re', 'patched distribution/Sury pac', 'fix still bei'.
• low llms.txt's Data list still omits the files the pages cite, and the markdown twin's links still point to HTML, so a tool walking markdown falls back to HTML. (llms.txt)
  patching/index.html cites 'data/patching.json', review/index.html cites 'data/review.json'; neither is under '## Data'. flaws/index.md links '../sources/cve-cve-2026-109618/index.html'. llms.txt is also now 150 KB and 727 lines, much of it team, GRC and design-mockup pages a tool asking about the bug does not need.
• low About 360px of site chrome sits above the H1 on technical pages at 1440x900. (code/index.html)
  metrics.json: H1 'The code: where the bug is, and what the fix does' at top 360; fold.png shows the two-row nav, the explainer banner, the reading bar and the research strip before it.

What this reader would change, in order

1. Add a 'Verify your image' block with copy-paste commands: docker run --rm <image> php -v, a version-independent check such as php -r 'var_dump(ini_get("max_multipart_body_parts"));' if the site can confirm only patched builds have it, and the distro changelog or package-version check for backports. (briefings/developer/index.html, medium)
   This half of my question is still unanswered, and php -v alone gives the wrong result on the Ubuntu backports the site lists as fixed.
2. Give the Docker Official Image row the fixed tags per variant (cli, fpm, apache, alpine) and the rebuild date. (patching/index.html, small)
   I build on php:*-fpm and php:*-apache; without tags I cannot check my Dockerfiles or pinned digests.
3. Move patching and affected to the inventory commit the front page says it has read (751 products), or say on each page why they stay on cca173c64ec5, and fix 674 versus 675. (patching/index.html, small)
   Three different inventory sizes across the site make me unsure which number to cite.
4. Update the 'still open' item on the incomplete fix with PHP's public answer of 22 October, as the v0.5.8 notes already say. (index.html, small)
   When the release notes say a page is out of date and the page is unchanged, I start doubting the rest.
5. Add affected_ranges and fixed_versions per branch to status.json and link data/affected.json and data/patching.json from its links block. (status.json, small)
   Then a CI step or an LLM tool can gate on the data instead of parsing a prose headline.
6. Add Swoole, RoadRunner and Octane worker rows to the SAPI table, saying 'not covered by the primary sources' if that is the truth. (flaws/index.html, small)
   Long-running workers are where cross-request stale state should worry a Laravel team, and silence reads as 'not affected'.
7. Mark the elisions in the hunks or drop 'verbatim', colour + and - lines, and link the hash to the upstream php-src commit. (code/index.html, small)
   I want to grep and diff these myself, and in dark mode removed and added lines blur together.
8. Fix the cPanel row placement and truncated product text, and list data/patching.json and data/review.json in llms.txt with .md links in the twins. (patching/index.html, small)
   A row under 8.1 listing only 8.2 to 8.4 packages makes me doubt the ladder, and tools should be able to stay in markdown and JSON.

Lines this reader reacted to

• briefings/developer/index.html: Nothing in userland blocks the demonstrated paths: ini_set() runs too late, .user.ini runs too late, auto_prepend_file runs too late.
  Still exactly what I need first; it kills the idea of a code-side hotfix.
• briefings/developer/index.html: Check the running version where the code runs: php -v inside the container or phpinfo() on the box, after the restart. The package list is not the answer.
  Word for word what it said last time. Right instinct, still not enough for images or backports.
• flaws/index.html: The CVE records carry defaultStatus 'unaffected' and list only 8.2 to 8.5, so an automated scanner reading the CVE will call 7.4 to 8.1 unaffected.
  Still the sentence that would have saved me in CI.
• code/index.html: Each step names the function or file it comes from; the hunks below are verbatim.
  And the hunks still contain '...'. Small, but it is the kind of claim I check.
• patching/index.html: fixed Docker Official Images maintainers: Docker Official Image: php
  Fixed which tags? Still the row where I needed detail and got none.
• patching/index.html: 46 fixed · 206 still affected · 418 under investigation · 3 not affected, of 674 products in the NCSC-NL inventory at commit cca173c64ec5
  The release notes say 675 at this commit and 751 now; this page says neither.
• admin/versions.html: so the front page's 'not answered publicly yet' is out of date
  The site knows its front page is wrong and the front page still says it a day later.
• review/index.html: Never a model, so it cannot invent a function that is not in the diff.
  The right provenance claim for a code map, and one I can check against git show.

Since the last run

Almost nothing I asked for on v0.4.3 is fixed on v0.10.18: the image verification step, the Docker tags, the Ubuntu backport trap, status.json versions, the Swoole and RoadRunner rows, the cPanel row, the truncated rows, the 'verbatim' hunks with elisions, the uncoloured diff, the missing data files in llms.txt and the .html links in the markdown twin are all still open, and the 674 versus 675 correction is still not applied. Small gains: status.json now carries cves, data_as_of and vault_commit. Worse: the patching and affected pages now lag the 751-product inventory the front page says it has read, and the 'still open' lists on index.html and the developer briefing contradict the v0.5.8 note that PHP answered the incomplete-fix report on 22 October. The instruments' 11.84px text on index.html, the briefing and review did not hurt me at 1440x900 in dark mode; the code block, at 12px and above, was readable. No page text addressed me or an AI.

Reviewer: agent-session.

The journey

The pages in the order read: the start, the reader's path, then the links that matched its interests.

What the instruments flagged

Measurements, not verdicts: the review says which of them mattered to this reader.

Everything this run saw

Vault 3l7tzwh9 · read key sgit_public_read_7208ee9cc71d170283b3a7ec3ec879fcc4a70b4974652d7cc4cd55b8ae43e894:3l7tzwh9 (read-only, published on purpose)

Open the vault read-only in a new tab ↗ · sgit clone sgit_public_read_7208ee9cc71d170283b3a7ec3ec879fcc4a70b4974652d7cc4cd55b8ae43e894:3l7tzwh9

This run is in the folder runs/2026-10-23T2357Z/: the served and rendered HTML, the text and the screenshots of every page, every request and console message, and what the reviewer was given.