PHP2Shell MSP Response Toolkit | Version 1.0 | 2026-10-21

Contents:
- PHP2Shell_MSP_Emergency_Response_Playbook_v1.0.docx (main resource)
- Windows-PHP-Discovery.ps1 (read-only discovery leads, CSV output)
- Linux-PHP-Discovery.sh (read-only discovery leads to terminal/stdout)
- Customer-Asset-Tracker.csv
- Vendor-Dependency-Tracker.csv
- Response-Decision-Log.csv

SAFETY:
- No exploit attempts, active scanning, remote probing or changes are included.
- Tools are incomplete by design. They are NOT vulnerability verification, compromise detection, or proof of no exposure.
- Run only in systems you administer or are authorized to assess.
- Review scripts in your own environment before using RMM at scale.
- Capture data in controlled storage. Internal paths, hostnames, contacts and incident context are sensitive.
- Update vendor guidance and the official PHP security advisory before taking action.
- On any suspected compromise, preserve evidence and contact the response lead before restarts/rebuilds.

Windows execution example (PowerShell from a trusted admin session):
  .\Windows-PHP-Discovery.ps1 -OutputCsv .\windows-inventory.csv
  .\Windows-PHP-Discovery.ps1 -ExtraRoots 'D:\Apps','E:\Services'

Linux execution example (on a host you administer):
  bash Linux-PHP-Discovery.sh > linux-inventory.txt

Follow the playbook for human verification, vendor backport checks and closure.
