PHP NETWORK AUDIT — UPDATE GUIDE (rules verified 2026-10-23)

1. Prioritize exposed management interfaces and legacy PHP. Restrict management
   access and isolate unpatched systems as appropriate. Review firewall/NAT,
   reverse-proxy and remote-access exposure separately; an internal scan cannot
   establish public exposure.

2. Identify the actual device model, firmware and web-serving PHP runtime. A
   response banner can be hidden, spoofed, stale or belong to a proxy. CLI PHP can
   differ from FPM/Apache/IIS. Vendor backports can fix an older version number.
   A missing header or an unreachable port is never a clean bill of health.

3. Ordinary Debian/Ubuntu servers:
   Copy update-debian-ubuntu.sh to the intended server using your existing secure
   admin method. Run locally there, not on a Windows scanner or vendor appliance:

       bash update-debian-ubuntu.sh

   This previews installed versioned PHP packages and an APT simulation using
   existing package metadata. After checking the vendor advisory, backup/restore
   plan and maintenance window:

       sudo bash update-debian-ubuntu.sh --apply

   Apply asks for BACKUP-READY before refreshing metadata, displays candidates
   and a fresh simulation, asks for APPLY-PHP, then leaves APT's final prompt on.
   It refuses held PHP packages and package removals. It does not add repositories,
   choose a new PHP branch, update containers or replace custom builds. Dependencies
   may also update and package hooks may restart services. APT configuration is
   trusted local admin configuration; review it and the final transaction.
   The helper does not guarantee candidate packages contain the fixes. Confirm
   BOTH CVEs against the distribution/vendor bulletin; backport versions differ.

4. Windows/IIS and bundled PHP:
   Run windows-inventory.ps1 locally from PowerShell under your normal execution
   policy. Optional -SearchPath parameters add custom directories. It reads file
   metadata, running PHP process paths and readable IIS FastCGI mappings; it never
   executes discovered binaries. Install the vendor's matching PHP build, checking
   architecture, thread safety, extensions and configuration. Back up, test, restart
   affected workers and verify the application. No generic Windows replacement is
   included: a wrong build can take IIS or the vendor application down.

5. Firewalls, NAS, printers and other appliances:
   Apply the vendor's approved firmware/product update. Do not install generic PHP
   packages on these devices. Consult the NCSC software inventory and the vendor's
   advisory for the exact model/release. If no fix exists, restrict/isolate or plan
   replacement according to the device's operational requirements.

6. Containers: rebuild and redeploy the affected images, then verify all running
   instances. Updating the host's PHP does not patch container images.

7. Restart EVERY affected web-serving worker using your stack's runbook. Test
   application health, verify deployed package/build evidence for both CVEs,
   and rescan. A fixed-looking header is supporting evidence, not proof. If prior
   exploitation is suspected, preserve logs and follow incident response; a PHP
   update does not remove an existing compromise.

Upstream baselines: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
Older branches: upgrade or verify a vendor-provided backport. Temporary runtime
settings are not complete fixes. Rules are dated; consult current advisories.

https://github.com/NCSC-NL/php2shell
https://cert.europa.eu/publications/security-advisories/2026-018/
https://www.php.net/archive/2026.php

This package contains no automatic remote login, exploit test, credential store,
firmware flasher or universal patch button. Scanner results stay local.
