PHP2List, created by zer0lightning, is an independent, unofficial website that makes the public NCSC-NL php2shell software list easier to search, filter, share and export during the response to the PHP2Shell vulnerabilities.
Why it exists
When PHP2Shell was disclosed, NCSC-NL and its contributors began publishing a valuable inventory of software that depends on PHP, with a status for each product. It's published as 27 alphabetical Markdown pages on GitHub, which works well for maintaining it, but is hard to use when you need a quick answer:
- You can't search across all the pages at once, or filter by status.
- There's no easy way to keep an eye on just the vendors and products your organisation actually uses.
- Getting the data into a spreadsheet or ticket for your team takes manual work.
- It's hard to see the bigger picture: how many listed products are fixed, and how fast that's changing.
PHP2List adds a fast, searchable view on top of the same data, without changing it, so defenders can spend less time looking things up and more time patching.
What you can use it for
- Check your software: search by supplier, product, version or note text, and filter by status for either CVE.
- Track what you run: build a watchlist of exact suppliers, exact products or keywords, and see only those.
- Share with your team: send a link that opens the same watchlist and filters, or bookmark it to come back to.
- Feed your process: export to CSV or JSON for asset inventories, tickets or reports, including a per-vendor summary.
- Follow progress: the patch progress page shows how many listed products are fixed or still open since disclosure.
- Brief others: the status overview and charts give a quick picture for colleagues or management.
What it is not
- Not an official source. PHP2List is not NCSC-NL or php2shell.com and is not affiliated with or endorsed by them, or by the PHP project. It only displays NCSC-NL's public list.
- Not a vulnerability scanner. It doesn't check your servers. To know whether you're exposed, check the PHP version actually running on each system and your vendors' advisories.
- Not a complete inventory. The list covers products someone has added to it. A product that isn't listed may still be affected, and your own custom PHP applications aren't covered at all.
- Not a verdict. Statuses come from the source list and are investigation leads. PHP2List doesn't verify vendor claims.
- Not security advice, and not a support service. See the disclaimer. Corrections to the list belong with NCSC-NL.
- Not collecting your data. Your watchlist stays in your browser; see the privacy notice.
How it works
- The site reads the list from the NCSC-NL repository on GitHub about every 30 minutes and shows it with the same columns: Supplier, Product, Version, the status for each CVE, Notes and Links.
- Nothing in the data is added, removed or edited. If GitHub can't be reached, the last copy is shown with a clear warning.
- The patch progress charts are rebuilt from the list's own changelog.
- The site loads nothing from other websites and has no analytics or tracking.
Open source
- PHP2List's code is open source under the MIT licence: PHP2List on GitHub. You're free to use, copy, modify and run your own copy.
- The software list is not part of PHP2List's code. It's © NCSC-NL and contributors under the EUPL-1.2 licence (TLP:CLEAR), and those terms also apply to the data in exports.
- If you run your own copy, it can read from a fork or mirror of the list if the original ever becomes unavailable.
Credits
All credit for the list belongs to NCSC-NL and its contributors, and for the research to the PHP2Shell researchers. See the acknowledgements.