# Source: PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Safeguard (vendor blog): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · secondary · captured

# PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog

**Safeguard (vendor blog)** · [https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes](https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes) · published 2026-10-21 · added by `claude-story-site` · slug `safeguard-how-hard-to-exploit`

Secondary analysis of exploit difficulty: a public PoC that failed under test; the upload-progress primitive is real; quotes a PHP core developer on Mastodon that patching is the only mitigation.

## What it says, as the collector read it

#### PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog

Captured by claude-story-site. Status: captured. Secondary analysis of exploit difficulty: a public PoC that failed under test; the upload-progress primitive is real; quotes a PHP core developer on Mastodon that patching is the only mitigation.

- Secondary; cites Kostas's test of the PoC and Gina Peter Banyard's Mastodon post (neither captured).

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T113039Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes- `headers.json` f024dda4aca45ee7784179ce10f5502c7cdc1848b68820c5e3ac4d5ae9977fe4 1,910 bytes
- `page.html` ca8f171043e3a56f99149b1ffa731bfdd00faa1aca0dde315bab896ba544148f 419,051 bytes
- `provenance.json` dc78d80894e1f67eb84e8f3dbcb4fce3d4687ae21172b11e13dab9e452491777 1,094 bytes
- `rendered.html` d50d0675b422cf74595a98594b026b8936b4a597bfdd8e14bf6417f1fb65c089 425,970 bytes
- `screenshot.png` 81bc77d288b0f16b3a5aff9755c8f70d850d79e54d2f786960ea233e942d2e24 3,150,477 bytes
- `text.txt` 271a233b1b8e628f66e764b3e3f089b09951d09ecdbb5fb9ef39d619eae623e9 37,594 bytes
capture 20261023T160435Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes- `headers.json` d50c6a9ddd97239fa2ed1d9614882d0507ba77f07c9484fc833498c7ed6307d6 1,917 bytes
- `page.html` 959573a3f2c3d2e8848e4f61f7cabb007ee6331d4673a54a6d7c1c9b66bc230d 419,348 bytes
- `provenance.json` f8b12a3e1a08e3c7e4903cb98245fd94c2e743c19e8e39a9278b9eaf6432b84f 1,844 bytes
- `rendered.html` 0a7a5c755f46e5b6dbf8c621456c0772fb7d7a77d2a2c3994eb743198469366d 417,090 bytes
- `screenshot.jpg` 73084c3582950994b826c9dbfbaaac7cf5304f70bb032169e76d55d2ecc92382 855,170 bytes
- `text.txt` b71f6bcecfb482abe1ff03d2d333d48f6729f67fad7c3525ff8abacfb7b03a67 38,094 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/safeguard-how-hard-to-exploit/index.html