Deploy Read-Only Security Auditing Across Your Entire Infrastructure
Zero dependencies. Read-only by design. Detects unauthenticated remote code execution vulnerabilities in PHP-FPM, Apache mod_php, FrankenPHP, and Node.js with safe configuration rollback.
Deployment Wizard and Command Generator
Select your target operating environment for instant, copy-paste ready deployment instructions.
Run directly on any bare-metal Linux or macOS server. Works without PHP or Node installed:
curl -fsSLO https://raw.githubusercontent.com/malikad778/php2shell-guard/main/bin/audit.sh && sh audit.sh scan
- 1Downloads standalone POSIX-compliant audit script with SHA256 integrity verification.
- 2Audits PHP web SAPIs (FPM, Apache mod_php, FrankenPHP) and Node.js runtimes.
- 3Discovers log compromise indicators (IOC1-IOC7) without generating false positives on clean systems.
Run via standalone compiled PHAR archive or PHP script runner:
php -r "copy('https://raw.githubusercontent.com/malikad778/php2shell-guard/main/php2shell-guard.phar', 'php2shell-guard.phar');" && php php2shell-guard.phar scan --format=table
- 1Compatible with PHP 7.4 through PHP 8.5+.
- 2Execute client-ready HTML reports:
php php2shell-guard.phar scan --format=html --output=audit-report.html - 3Check advisory database freshness:
php php2shell-guard.phar db:verify
Integrate into Laravel, Symfony, or modern PHP projects:
composer require --dev malikad/php2shell-guard && php artisan php2shell:audit
- 1Automatically registers Artisan command in Laravel applications.
- 2Integrates with Spatie Health checks for continuous production monitoring.
- 3Plan safe PHP upgrades:
php vendor/bin/php2shell-guard upgrade:plan --to=8.4
Instant execution via npx or npm global installation:
npx php2shell-guard scan --format=markdown
- 1Scans Node.js Brotli decoder exposure (CVE-2026-111497) and PHP backend runtimes.
- 2Inspects shared vs bundled Brotli libraries:
node bin/php2shell-guard.mjs node:scan
Audit running Docker containers, images, and Coolify deployments:
sh audit.sh scan --docker
- 1Inspects all active containers running PHP-FPM, Apache, or Node.js.
- 2Detects containers executing old unpatched base images despite updated tag labels.
Audit entire Kubernetes cluster pod workloads via kubectl:
php php2shell-guard.phar scan --k8s
- 1Enumerates all pods across namespaces inspecting container image tags.
- 2Exports results to SARIF 2.1.0 for automated GitLab or GitHub Code Scanning ingestion.
Interactive Vulnerability Evaluation Engine
Test your runtime version against active security advisories in real time.
Engine Architecture and Security Guarantees
Built for enterprise compliance, high-availability environments, and strict safety rules.
Read-Only Safety Guarantee
Never modifies system files, services, or network states unless explicitly instructed via the apply command with double confirmation.
Atomic Pre-Validation Rollback
When applying mitigations, syntax checks (nginx -t, php-fpm -t, apache2ctl -t) execute before activation. Any failure triggers automatic rollback to backup.
False-Positive Free Log Scanner
Targeted log discovery scans real web error logs and process trees while ignoring vendor code and test fixtures. Strictly adheres to the IOC7 wording rule.
Multi-Format Enterprise Reporting
Outputs standalone responsive HTML dashboards, print-ready PDF summaries, SARIF 2.1.0, JUnit XML, Markdown, CSV, and Diff reports with white-label options.
Dynamic Multi-Vulnerability Feed
Automatically ingests new security advisories from local JSON definitions or remote feeds. New branches and zero-days are identified without code redeployments.
Distro Package Backport Aware
Differentiates upstream releases from Debian, Ubuntu, Alpine, and RHEL package versions. Parses distribution changelogs to detect patched backports.
Releases and Binary Downloads
Official verified standalone releases, cryptographic checksums, and package tags.
179b24f4a925b63e94f0f7a51da4ab1b73313bde439135c93389c6b674e24d68 php2shell-guard.phar a96c14fea63b947264bb28d8616f64d60fca61d0b8e338a42a9c17e6d86a19f3 audit.sh f7bbe811ee02eafdb2f5354a2751723762641460b7330e234dd4647d69c68834 php2shell-guard.mjs f4ef1a81b4b5437e21f955021e1166085092664b503ec50fbe0735989c0fb9c7 audit-legacy.php
Malik Adnan builds hardened infrastructure tools, defensive runtime security guards, and automated DevSecOps pipelines. php2shell-guard was authored to provide engineers and site reliability teams with an instant, zero-dependency, safe scanner for PHP2Shell and Node.js vulnerability waves with automated rollback protection and accurate log discovery.