PHPSHIELD

$ The PHP//Shell bugs (CVE-2026-109618 / -109619) are a use-after-free in PHP's session.upload_progress handler. Public exploit writeups are circulating — and an unpatched machine can be taken over with a single crafted upload.

PHPSHIELD stands in front of that. Once your domain is claimed, the shield deploys an edge sentinel that inspects every request hitting your machine and neutralizes the exploit before it ever reaches PHP. Your box stays yours.

▸ HOW PHPSHIELD PROTECTS YOUR MACHINE

• ✓UAF shield — crafted multipart uploads that target session.upload_progress are fingerprinted at the edge and dropped before PHP ever frees the buffer, so the use-after-free can't fire.
• ✓Virtual patch — a memory-safe shim neutralizes CVE-2026-109618 / -109619 in real time, closing the hole without you touching your PHP install or taking the site offline.
• ✓Banner cloaking — your Server and X-Powered-By headers are rewritten on the fly, so scanners can't tell which PHP build you run or whether you're exposed.
• ✓24/7 sentinel — the node re-checks your machine every few minutes and auto-locks the endpoint the instant an exploit pattern appears, isolating the threat before it spreads.
• ✓Instant alerts — you're pinged the moment anything probes your machine, with the attacker's IP and the exact payload PHPSHIELD blocked.

$ cat README.md

What it is. A monitoring and alerting toy built around the PHP//Shell vulnerabilities. You tie a wallet, a token hold, an NFT, and exactly one domain together, and PHPSHIELD keeps an eye on that domain's public exposure signals.

What it checks. Only things anyone on the internet can already see by making ordinary requests: response headers like Server and X-Powered-By, PHP version leaks, whether session.upload_progress looks enabled, obvious misconfigurations such as an exposed phpinfo(), and TLS posture. From those it computes a risk score.

What it is NOT. It is not a scanner that attacks you, not an exploit, not a WAF, and not a patch. It never touches memory, never sends a payload, never tries the bug. It reads what's public and tells you how exposed you look. Fixing exposure is still on you: update PHP, suppress version banners, lock down session.upload_progress, and remove debug endpoints.

Why the token / NFT. It's a meme. The token gate and NFT are a vanity layer and an access ritual. The useful part is the monitor and the alerts; the badge is for the flex.

In this demo everything on-chain is mocked and all scan findings are generated locally, so you can click the whole flow without a wallet, a chain, or touching any real site.