PHP2Shell Vulnerability - Audit
Summary
Displays the PHP installations found by the PHP2Shell Vulnerability - Audit script and whether each one is affected by PHP2Shell, from the table pvl_php2shell_vulnerability_audit.
Each PHP installation is shown as one row. Computers without any PHP installation are shown once with the status NotDetected. Filter the Status column on Vulnerable and EndOfLife to list the installations that need attention.
Dependencies
- Custom Table: pvl_php2shell_vulnerability_audit
- Script: PHP2Shell Vulnerability - Audit
- Internal Monitor: Execute Script - PHP2Shell Vulnerability - Audit
- Solution: PHP2Shell Vulnerability Audit
Columns
| Column | Explanation |
|---|---|
| ComputerId | The Automate Computer ID of the agent. |
| Client | The name of the client for this computer. |
| Location | The name of the location for this computer. |
| Computer | The name of the computer where the audit was performed. |
| Operating System | The OS installed on the endpoint. |
| Last Logged In User | The last user logged into the device. |
| Form Factor | The type of computer: 'Physical Server', 'Virtual Server', 'HyperV Host', 'Virtual Workstation', 'Laptop', or 'Desktop'. |
| Path | The folder of the PHP installation. |
| Name | The product that owns the installation: 'PHP' for a standalone installation, the stack name (e.g., 'XAMPP'), the bundling application, or 'Unknown application'. |
| Publisher | The publisher of the owning product, when known. |
| IsNative | 'True' for a standalone PHP installation, 'False' when PHP belongs to a stack or another vendor's product. |
| InstallType | 'Standalone', 'Stack', or 'Vendor'. |
| ManagedBy | 'Winget' for a winget installation for all users, 'Winget (user scope)' for a winget installation in a user profile, otherwise 'None'. |
| PackageId | The winget package ID of a winget installation (e.g., 'PHP.PHP.NTS.8.3'). |
| ExecutablePath | The PHP file the version was read from (php.exe, php-cgi.exe, or the PHP engine DLL). |
| Version | The installed PHP version. After a successful update, the new version. |
| Architecture | 'x64', 'x86', 'arm64', or 'Unknown'. |
| ThreadSafety | 'TS' (thread safe), 'NTS' (non-thread safe), or 'Unknown'. |
| InIis | 'True' when IIS uses the installation, otherwise 'False'. |
| Running | 'True' when PHP from the installation was running during the audit, otherwise 'False'. |
| Status | 'Patched', 'Vulnerable', 'EndOfLife', 'Unknown', or 'NotDetected' when the computer has no PHP installation. |
| RequiredVersion | The first patched release for the installation's version line (e.g., '8.3.36'). |
| Action | What the script did with the installation: 'None', updated, skipped with the reason, or failed with the reason. |
| ScriptRunTime | The timestamp of when the script executed and populated this record. |
Changelog
2026-10-23
- Initial version of the document.