Run the tool

Quickest: run it straight from the web

curl -fsSL https://wasdthedebugger.github.io/php2shell/fix | php

Use | sudo php if PHP's config needs admin rights, and | php -- --check to only look. Works on Linux and macOS.

1. Or download it

curl -fsSLo php2shell.php https://wasdthedebugger.github.io/php2shell/fix

Windows (PowerShell): curl.exe -fsSLo php2shell.php https://wasdthedebugger.github.io/php2shell/fix. Downloading first lets you read the script before running it. It's a single plain PHP file.

2. Run it

SystemCommand
Linux / macOSphp php2shell.php
Use sudo php php2shell.php if PHP's config needs admin rights to edit.
Windowsphp php2shell.php in a Command Prompt opened as Administrator
XAMPP: C:\xampp\php\php.exe php2shell.php

No PHP command? Use the full path to the PHP your site uses, e.g. /usr/bin/php8.3.

3. Answer the questions

  1. How your site runs PHP (PHP-FPM, Apache, IIS, Docker, shared hosting...)
  2. Which config file your site uses. The tool lists the ones it finds.
  3. Your website's PHP version. It tells you if you're patched.
  4. Whether you need file uploads, and how big
  5. Each fix, one by one: apply it or not
  6. A preview of the exact lines, then a final yes/no

It never restarts anything. It tells you the restart command.

Other modes

php php2shell.php --check    look only, change nothing
php php2shell.php --undo     restore a backup
php php2shell.php --help

Backups

Before any change, the original file is copied to ~/.php2shell/backups/<date>/ (%USERPROFILE%\.php2shell\backups on Windows). Backups are kept outside your project, so they're never public on your website. --undo puts them back. If the file was edited again since, it warns you first.

Where it writes

If your PHP has a conf.d folder, the tool adds one small file, 99-php2shell.ini, and doesn't touch php.ini. Otherwise it edits php.ini: old lines are commented out, not deleted.