psf-php2shell-edge-test(8)

Script: /opt/psf-security-patches/php/edge/php2shell-edge-test.sh. Tool page: PHP2Shell edge guards. Source. With the package installed: man psf-php2shell-edge-test.

PHP2Shell edge guard tester  (v1)
CVE-2026-109618 / CVE-2026-109619

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

Checks that an edge guard from this folder (the Apache .conf, the Apache
.htaccess or the nginx snippets) behaves the way you think it does on a given
URL. It sends a handful of small, benign requests (a form field named "a"
with the value "b", never exploit content) and reads the status codes. It
needs only bash and curl, and nothing on the server being tested.

A pass here shows the tested URL behaves as described. It does not show a
server is safe from either CVE, does not cover other paths or virtual hosts,
and cannot tell which component refused a request. Patching PHP is the fix.

Usage:
  ./php2shell-edge-test.sh [options] URL

  --expect MODE    block     (default) the guard is enforcing: a multipart
                             POST to URL must get 403
                   dry-run   the .htaccess dry run: a multipart POST must NOT
                             get 403 and must carry X-PHP2Shell-Guard
                   log-only  the .conf or nginx log-only mode: a multipart
                             POST must NOT get 403 (add --log FILE to also
                             confirm the guard logged it)
  --allow PATH     a path on your allowlist (for example /wp-admin/async-
                   upload.php). A multipart POST to it must NOT get 403, and
                   one to PATH.bak must get 403 when enforcing
  --log FILE       a log the guard writes to; used with --expect log-only
  --host NAME      send this Host header (the URL may be 127.0.0.1)
  --insecure       do not verify a TLS certificate
  -h, --help, version

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

The PrivacySafe Ecosystem

Ivy Cyber offers PrivacySafe products and services in the USA and has partnerships with 3NSoft in Canada and Kuip Limited in the European Union. Enterprise services and consulting are available at ivycyber.com

PrivacySafe Foundation is a 501(c)(3) nonprofit public charity that supports the development of the PrivacySafe applications, along with the components they rely upon: 3NWeb protocols, filesystem, documentation, and reference implementations.

Donations to PrivacySafe Foundation support education, research, documentation, and public code. Purchases from Ivy Cyber support PrivacySafe products, services, hosting, and technical support. Together, we're building a better web.