- This is not NCSC-NL or php2shell.com. PHP2List is an unofficial, independent site, not affiliated with or endorsed by NCSC-NL, php2shell.com or the PHP2Shell researchers.
- Accuracy is not guaranteed. The information may be incomplete, out of date or wrong.
- Use it at your own risk. You are responsible for any decisions you make based on it.
- Always verify with the vendor's own advisory before acting.
- It is not security advice, and no warranty of any kind is given.
- No support is offered. Questions, corrections, new entries and feature requests are not handled here; list changes go to NCSC-NL/php2shell.
Not NCSC-NL, not php2shell.com, not an official source
PHP2List is an independent, unofficial website. It is not NCSC-NL (the National Cyber Security Centre of the Netherlands) and is not operated by or on behalf of NCSC-NL or the Dutch government. It is also not php2shell.com, the official site of the researchers who found the PHP2Shell vulnerabilities. PHP2List is not affiliated with, sponsored by or endorsed by any of them.
The site displays a list that NCSC-NL and its contributors publish openly on GitHub under the EUPL-1.2 licence. Showing that list, naming NCSC-NL as its source and linking to it are attribution, not a claim of any relationship. Nothing on PHP2List should be read as a statement, assessment or advice from NCSC-NL.
Likewise, PHP2List has no connection with the PHP2Shell researchers (Wiz Research, OpenAI and Calif), the PHP project, The PHP Foundation, CERT-EU, ENISA, or any other organisation named on this site. The name "PHP2Shell" refers to the vulnerabilities, not to this website.
Please do not contact php2shell.com or the researchers about this website either. For official information, go directly to the sources: the NCSC-NL/php2shell repository, php2shell.com, the PHP security advisory, and your vendors' advisories. Please do not contact NCSC-NL about this website; it has nothing to do with them.
Where the data comes from
Every entry shown on PHP2List comes from the software list in the NCSC-NL/php2shell repository on GitHub, maintained by NCSC-NL and its contributors and published under the EUPL-1.2 licence. PHP2List reads that list automatically and displays it; it does not add, remove or change entries, statuses, versions or notes.
The source list itself states that it is not complete, that no guarantees are made about its completeness or accuracy, and that entries should be verified against upstream or vendor sources before acting on them. The same applies here.
Not security advice
Nothing on this site is professional security, legal or compliance advice. A status in the list is an investigation lead, not a verdict about your systems. In particular:
- Investigation means a product may be affected and is still being assessed.
- A product that is missing from the list may still be affected. The vulnerabilities are in PHP itself, so any software that runs on or bundles an affected PHP runtime can be exposed.
- Custom PHP applications developed or deployed by your own organisation are not covered by the list.
- Products may ship embedded PHP runtimes, receive vendor backports, or be rebuilt later than upstream releases. Always confirm with the vendor's own advisory.
For authoritative guidance, start with the PHP security advisory, php2shell.com, your vendors' advisories, and your national CSIRT.
Timeliness
PHP2List checks the source list for changes about every 30 minutes, so it can lag behind the repository. If GitHub cannot be reached, the site keeps showing the last copy it fetched successfully, for up to seven days. The time shown as "Software list last status update" is the time reported by the source repository, not the time PHP2List last checked.
Your vendor watchlist and exports
Vendor matching is a convenience based on names. A watchlist entry is matched as a whole word against supplier and product names in the list, so it can miss products listed under a different company name, or match products you do not use. Review exported files before relying on them, for example in reports or audits.
No support
PHP2List is provided as a free convenience, without any support. In particular:
- No maintenance commitment. There is no promise that the site will be kept up to date, fixed when something breaks, or kept online. It may be changed, paused or taken down at any time without notice.
- No help with the list. Questions about specific products, statuses or your own exposure are not answered here. Please contact the vendor concerned, or your national CSIRT.
- No new entries or corrections. PHP2List cannot add, remove or correct entries; it only displays the source list. To suggest a change, follow the contribution guidelines of the NCSC-NL/php2shell repository. Once a change is accepted there, it appears here automatically.
- No feature requests. Requests for new features or changes to how the site works are not taken.
Links to other websites
This site links to vendor advisories, research publications and other third-party pages. PHP2List does not control and is not responsible for their content, availability or accuracy.
Use at your own risk; no warranty
The accuracy, completeness and timeliness of the information on PHP2List are not guaranteed. You use this site and the information it displays entirely at your own risk, and you remain responsible for verifying it and for any decisions or actions you take based on it.
PHP2List and the information on it are provided "as is" and "as available", without warranty of any kind, express or implied, including any warranty of accuracy, completeness, merchantability or fitness for a particular purpose. To the extent permitted by law, the operator of PHP2List is not liable for any loss or damage, direct or indirect, arising from use of, or reliance on, this site or the information it displays.
Information sharing (TLP)
The source repository marks its content TLP:CLEAR, meaning it may be shared without restriction.