=== PHP2Shell Guard ===
Tags: security, php, vulnerability, site health, cve
Requires at least: 5.8
Tested up to: 6.9
Requires PHP: 7.0
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Checks whether your server's PHP is exposed to PHP2Shell (CVE-2026-109618, CVE-2026-109619) and tells you exactly what to change.

== Description ==

PHP2Shell is a pair of critical memory-safety vulnerabilities in PHP itself, disclosed on 21 October 2026. They allow unauthenticated remote code execution and memory disclosure on any PHP site, including WordPress, independent of themes and plugins.

**Important: no WordPress plugin can block this attack.** The vulnerable code runs while PHP parses the incoming request, before WordPress loads. Changing settings with ini_set() from a plugin is too late. The only fix is updating PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or installing a vendor backport).

What this plugin does:

* Checks the running PHP version against the fixed releases, including PHP 8.1 and older, which get no official fix.
* Checks the mitigations the PHP team recommends: session.upload_progress.enabled, fatal_error_backtraces (PHP 8.5), post_max_size / upload_max_filesize and memory_limit.
* Flags Apache mod_php, the setup the PHP team rates as highest risk.
* Scans readable PHP and WordPress error logs for bursts of out-of-memory errors, one of the signals of exploitation attempts.
* Generates ready-to-paste stopgap config for php.ini, PHP-FPM pools, Apache, .htaccess (mod_php) and nginx, matched to your server.
* Shows a dashboard warning to administrators until PHP is updated, and adds a Site Health test.
* Adds `wp php2shell check` for WP-CLI, exiting with status 1 when PHP is unpatched.

The plugin is read-only. It never edits server files, because a wrong line in .htaccess or a pool file can take a site offline.

== Installation ==

1. Upload the `php2shell-guard` folder to `/wp-content/plugins/`, or upload the zip under Plugins > Add New > Upload Plugin.
2. Activate it. On multisite, network-activate it; the report lives under Network Admin > Settings.
3. Open Tools > PHP2Shell Guard.

== Frequently Asked Questions ==

= My PHP version shows as vulnerable but my host says it is patched. =

Linux distributions and hosting panels often backport security fixes without changing the PHP version number. If your host confirms the backport for CVE-2026-109618 and CVE-2026-109619, you are covered. Dismiss the notice; it returns after 3 days as a reminder until the version number shows a fixed release.

= Why doesn't the plugin just turn off session.upload_progress for me? =

That setting must be applied before PHP parses the request. ini_set() and .user.ini apply too late. It has to go in php.ini, the PHP-FPM pool or the Apache config, followed by a restart of every PHP worker.

= Does WP-CLI show the same result as wp-admin? =

Not always. WP-CLI uses the command-line PHP, which can be a different binary and php.ini. Trust the wp-admin page for the website.

== Changelog ==

= 1.0.0 =
* First release.
