PHP Vulnerability Guide
English
PHP2Shell security update
Last updated: (UTC)

Data and logging policy

What the local checker, optional online version hint, downloads and analytics process, and which operational records the application retains.

PHP2Shell · CVE-2026-109618 / CVE-2026-109619 · PHP RCE · PHP security update

Last checked: · Source review; separate from content updates.

Short answer: Pasted version text stays in this browser tab. The optional online tool sends a hostname and human-verification token to the service. It reads only the HTTPS homepage response headers and cannot establish exploitability or compromise.

What the application processes and retains

  • Local checker: parses text in memory. It does not upload it, add it to the URL or save it in browser storage. Clear the field or close the tab when finished.
  • Online hint: requires consent and Turnstile. It resolves public DNS and sends at most one HTTPS homepage HEAD request on a cache miss, without following redirects or reading a page body. Cloudflare processes the submitted verification token and client IP for verification. Cloudflare documents the traffic dimensions it processes.
  • Abuse prevention: private R2 records use daily HMAC identifiers for IP and hostname limits. Limits are 6 requests per minute and 30 per hour per IP. A returned hint can be cached for 10 minutes. Records have a one-day lifecycle with asynchronous cleanup; raw IPs, hostnames and verification tokens are not stored in these application records.
  • Operational logs: the online endpoint logs outcome, HTTP status, cache use and elapsed time. Aggregate counters contain outcomes and counts. The application does not log the submitted hostname, raw IP or verification token. Infrastructure providers may separately process request metadata; this is not a promise of zero infrastructure logging.
  • Analytics: canonical public pages load visit analytics. Local checker events contain only category, branch and selected platform; guide events contain an internal path. No pasted text or full package revision is sent by those events. Add ?analytics=off to disable this site's analytics script for the visit.
  • Downloads: a necessary Secure, HttpOnly, SameSite=Strict cookie binds a five-minute mirror link to this browser. The cookie can last up to one hour and is not used for analytics.

These are statements about this site's application behavior, reviewed against its checker, analytics, online guard and download implementations. Read the full privacy notice for context. Source-check timestamps on security pages describe advisory verification, not collection of visitor data.

Sources & verification