Example files

Article: https://youdozi.github.io/en/posts/2026-10-30-php2shell-runtime-patching/

Extract into a new empty directory and run commands from that directory.

Environment
PHP 8.2 or later with the CLI, JSON and session support; POSIX shell command examples. No packages or network access required by the collector.

Commands
php runtime-evidence.php
php -n -d session.upload_progress.enabled=0 runtime-evidence.php

Scope
Read-only CLI process metadata, not web-worker identification or a vulnerability scanner. The second command overrides only its own CLI configuration. No patching, restart, exploit reproduction or production validation. Keep the file outside the web document root.

Read the article for outputs, conditions and failure cases. PROVENANCE.json records the source and file hashes; hashes establish identity, not correctness.
