Sairahcaz

#!/usr/bin/env bash
#
# php2shell-triage.sh
# Read-only triage for PHP2Shell (CVE-2026-109618 / CVE-2026-109619).
# It checks whether your PHP build was in the vulnerable range and looks for
# the few signals an exploitation attempt tends to leave behind.
# It also checks the follow-up session upload progress issue (CVE-2026-115560).
#
# It never changes anything on the system. It only reads logs and lists files.
# Run as root (or via sudo) so it can read FPM and auth logs:

ismyrnow

sudo rm -rfv /Library/Caches/com.apple.iconservices.store; sudo find /private/var/folders/ \( -name com.apple.dock.iconcache -or -name com.apple.iconservices \) -exec rm -rfv {} \; ; sleep 3;sudo touch /Applications/* ; killall Dock; killall Finder