This page covers our site only
To report a vulnerability in PHP itself, follow the PHP project's own process in the php-src repository's security policy. We cannot handle PHP vulnerabilities.
How to report
Email hello@php2shell.dev with a description, the URL and steps to reproduce. Our machine-readable contact is at /.well-known/security.txt.
What we promise
- A reply within three working days.
- No legal action against good-faith research that respects the rules below.
- Credit on this page if you want it.
Rules
- Do not access other people's data, run denial-of-service tests or use automated scanners at volume.
- Give us reasonable time to fix the problem before publishing.
Out of scope
Missing headers with no demonstrated impact, the Crisp chat service (report to Crisp) and Cloudflare's infrastructure (report to Cloudflare).
Last reviewed on 22 October 2026.