Use this repository's Security → Report a vulnerability feature for issues that need private disclosure. Include the affected commit, a minimal local reproduction, expected behavior, actual behavior, and impact. Omit secrets and third-party target data. Do not post exploit details in a public issue while a private report is being reviewed.

Only the current default branch is maintained; use its latest revision when reproducing a report. No response-time guarantee is made.

This repository performs passive version-based PHP2Shell exposure triage. It does not execute exploits or confirm vulnerabilities in websites. WordPress, PHP, or version detection alone is not a confirmed security finding. Direct any supported website-specific report to that site's published security contact or disclosure program rather than publishing its details in this repository.