FaultyPacket Logo FaultyPacket FREE TOOLS & AUDIT PACKS
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 3,678,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
✓ Chrome Web Store Live Release (v1.0.2 · 14/14 QA Verified): Inspects public SPF (first-level mechanism tokens), _dmarc, and _mta-sts / _smtp._tls DNS TXT markers via Google DoH plus browser-visible HTTP headers (HSTS, CSP/X-Frame-Options, X-Powered-By) with HTML-escaped evidence export. Evidence Scope Notice: Checks blocked by browser CORS or DNS lookup errors are explicitly marked UNAVAILABLE and never counted as pass or fail; an absent X-Powered-By banner does not prove host runtime patch level—use our authorised host/CLI scripts for runtime verification.
EMERGENCY PHP SERVER LOCKDOWN · CVE-2026-109618

Lock Down Your PHP Servers Against PHP2Shell (CVE-2026-109618) Before Automated Scanners Hit Your Site.

Check if your PHP runtime or web server is exposed to October 2026's critical RCE flaw. Use our free exposure checker and copy-paste Nginx, Apache, IIS & php.ini rules below—or grab the full lockdown pack (£12–£24) or a $15 24h Done-For-You fix on Fiverr.

Run Free Live Domain & CVE Triage Download Complete Remediation Pack — £24
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
Free Browser-Based Diagnostic · Cloudflare 1.1.1.1 DoH + PHP2Shell Perimeter Check

Live PHP2Shell (CVE-2026-109618 / 115560) & Edge Boundary Scanner

Enter any domain to run a real-time, non-intrusive DNS-over-HTTPS (DoH) edge boundary, CAA certificate lock, SPF/DMARC, and PHP2Shell perimeter exposure check directly from your browser.

Test live UK/global domains:

1. Vulnerability Summary & Affected PHP Versions

Disclosed in October 2026, PHP2Shell (tracked as CVE-2026-109618, CVE-2026-109619, and the follow-on runtime flaw CVE-2026-115560) is a critical unauthenticated Remote Code Execution (RCE) flaw in how unpatched PHP CGI/FastCGI handlers parse crafted query-string stream descriptors and environment overrides (allow_url_include / auto_prepend_file injection vectors).

  • PHP 8.5 Branch: Vulnerable below 8.5.12 (Patched in 8.5.12+)
  • PHP 8.4 Branch: Vulnerable below 8.4.27 (Patched in 8.4.27+)
  • PHP 8.3 Branch: Vulnerable below 8.3.36 (Patched in 8.3.36+)
  • PHP 8.2 Branch: Vulnerable below 8.2.35 (Patched in 8.2.35+)
  • PHP 8.1, 8.0, 7.4 & Older: End-of-Life (EOL) — requires immediate perimeter WAF/FastCGI rule blocking or runtime upgrade.
Open Interactive PHP2Shell Exposure Matrix →

2. Hunting PHP2Shell Indicators of Compromise (IOCs) in Access Logs

Before and after patching, audit your Nginx, Apache, and IIS access logs for encoded -d, auto_prepend_file, allow_url_include, and php://input stream probes:

# Search Nginx & Apache logs for CVE-2026-109618 / PHP2Shell exploit strings grep -E -i "(auto_prepend_file|allow_url_include|php://input|%2d%64|-d\+|cgi\.force_redirect)" /var/log/nginx/access.log* /var/log/apache2/access.log*

Our £24 Remediation Pack includes tools/php2shell_local_triage.sh, an automated read-only Linux/macOS forensic scanner that checks all installed php-fpm and CLI binaries, audits active php.ini files for dangerous directives, and scans compressed log archives automatically.

3. Defense-in-Depth: Nginx, Apache, IIS & php.ini Hardening

Even on patched runtimes, security baselines (NIST SP 800-53, ISO 27001, SOC 2, and UK Cyber Essentials v3.3 ("Danzell")) require stripping version leakage (expose_php = Off), disabling OS shell execution primitives in production, and blocking malformed FastCGI path splits:

; Excerpt from templates/php-ini-production-lockdown.ini expose_php = Off allow_url_fopen = Off allow_url_include = Off cgi.force_redirect = 1 cgi.fix_pathinfo = 0 disable_functions = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec
Download All 6 Server Templates + Triage Script — £24
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
➕ Install Free from Chrome Web Store

Frequently Asked Questions

Which PHP versions are vulnerable to CVE-2026-109618 (PHP2Shell)?

All PHP branches prior to the October 2026 security release: PHP 8.5 below 8.5.12, PHP 8.4 below 8.4.27, PHP 8.3 below 8.3.36, PHP 8.2 below 8.2.35, and all End-of-Life branches (8.1, 8.0, 7.x).

Can I mitigate PHP2Shell at the Nginx, Apache, IIS or Cloudflare WAF layer while waiting for a maintenance window?

Yes. Blocking query strings containing auto_prepend_file, allow_url_include, php://input and encoded -d arguments at your reverse proxy or WAF stops remote exploitation before requests reach PHP-FPM or FastCGI. Drop-in rules for Nginx, Apache, IIS and Cloudflare are included in the FaultyPacket £24 Remediation Pack.

FIX IT IN MINUTES (£5–£39) · OR USE OUR 100% FREE CHROME TOOLS

Deploy the Automated Fix in Minutes — Or Grab Our 100% Free Chrome Extensions

🛡️ Path A (For Teams & Audits — Paid ZIP Packs):

Need drop-in Nginx/Apache/IIS/Cloudflare configs, offline Python & PowerShell collectors, and board-ready HTML reports? Choose a standalone pack (£12 WP & WooCommerce Shield, £19 NIS2/DORA, £24 DMARC/PHP2Shell, £29 Cyber Essentials v3.3) or get all 4 in the £39 Complete 4-Pack Compliance & Web Shield Bundle (Save £45 / 54%).

DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack — £24
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
All 4 Packs Bundle — £39 (Save £45 vs buying all 4 separately)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
☕ Path B (100% Free Extensions & Diagnostics):

Both of our Chrome MV3 extensions are 100% Free Forever (zero paywall, zero telemetry). Download them below or fuel the Lab Fund:

Free Table Exporter MV3 (.zip) Free Security Inspector MV3 (.zip)
HONEST OPTIONS · FIX IT FREE VS. £5–£39 PACKS VS. $15 FIVERR FIX

Scanner Finding → Free DIY Fix → Paid Pack or 24h Done-For-You Mapping

Every FaultyPacket diagnostic separates what was observed publicly, the free DIY remediation step you can apply yourself immediately, the matching self-serve ZIP pack (£12–£39) or 24h Fiverr Done-For-You gig ($15–$175), and the exact evidence scope & exclusions. Looking for how we handle DNS transport failures? Open the Interactive Evidence Comparison Lab → or view our Sample Audit Report →.

1. Missing DMARC / SoftFail SPF / No MTA-STSEMAIL AUTH

Why It Matters: Unauthenticated senders can spoof executive domains or downgrade SMTP TLS.

Free DIY Fix: Publish _dmarc TXT "v=DMARC1; p=quarantine; rua=..." and flatten SPF to ≤10 lookups ending in -all.

Paid Pack / 24h DFY: £24 DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack (or $25–$95 Fiverr DMARC Gig).

Scope & Exclusions: Public DNS/TXT/MX & MTA-STS records only; excludes internal Exchange/Workspace tenant admin access.

2. WordPress wp_mail / REST / XML-RPC ExposureWP & WOO

Why It Matters: Unauthenticated user enumeration, XML-RPC brute-force amplifiers, and WooCommerce receipts landing in spam.

Free DIY Fix: Disable xmlrpc.php, filter /wp-json/wp/v2/users, and align SMTP DKIM/SPF headers.

Paid Pack / 24h DFY: £12 WP & WooCommerce Shield Pack (faultypacket-wp-shield.php MU-plugin) or $15–$55 Fiverr 24h Fix.

Scope & Exclusions: Zero wp-admin credentials required; drop-in MU-plugin + DNS records.

3. PHP2Shell (CVE-2026-109618 & -109619)RUNTIME / WAF

Why It Matters: Exposed PHP runtime banners, FastCGI/PHP-FPM env injection (CVE-2026-109618 & sibling CVE-2026-109619), and missing HSTS/CSP.

Free DIY Fix: Patch PHP runtime, set expose_php = Off, and lock FastCGI SCRIPT_FILENAME boundaries.

Paid Pack / 24h DFY: £24 DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack (Nginx/Apache/IIS/Cloudflare rules + IOC script) or $30–$110 Fiverr Gig.

Scope & Exclusions: Edge WAF/server config & passive header/IOC verification; non-intrusive (zero exploitation).

4. NIS2 Art. 21 / DORA & CE v3.3 ("Danzell") GapsGOVERNANCE

Why It Matters: Supply-chain DNS email posture blind spots and IASME Cyber Essentials v3.3 ("Danzell") assessment failures.

Free DIY Fix: Use our free browser NIS2 25-domain auditor & CE v3.3 readiness scorer with evidence-aware DoH checks.

Paid Pack / 24h DFY: £19 NIS2 Bulk Pack / £29 CE v3.3 Pack / £39 Complete 4-Pack Compliance & Web Shield Bundle (or $35–$175 Fiverr).

Scope & Exclusions: Public DNS posture score (0–100) & self-assessment templates; not an accredited certification body.

🔄 Opt-In Domain & WordPress Drift MonitoringDNS TXT VERIFIED

Want continuous checks after fixing your records? Pack and Fiverr buyers can enrol domains in our Opt-In Drift Monitor by publishing a read-only _faultypacket-verify.<domain> DNS TXT ownership token.

Zero-Spam Guarantee: Outbound drift alerts ([email protected]) are disabled by default and only fire when both explicit consent and _faultypacket-verify TXT ownership are verified and a baseline SPF/DMARC/MTA-STS/WP header drifts.

🏢 For Web Agencies & MSPs: Multi-Domain & White-Label ScorecardsMSP & AGENCY READY

Managing 10–250 client WordPress sites or Microsoft 365 domains? Our £39 Complete 4-Pack Compliance & Web Shield Bundle and Fiverr Pro Tiers include multi-domain batch auditing and White-Label Executive HTML Scorecards (--agency-name / --white-label) ready to hand directly to your clients.

Email [email protected] or order via Fiverr (@faultypacket) with your agency name and domain list.

GIG #2 SPOTLIGHT · 24H ASYNC DELIVERY ($30 / $45 / $65) OR £24 INSTANT PACK
Zero Calls · Zero Server Logins · 24h Delivery

Need Done-For-You PHP2Shell (CVE-2026-109618) Server Hardening & WAF Lockdown in 24 Hours?

Order our 100% asynchronous PHP2Shell & Web Server Hardening audit on Fiverr (@faultypacket) with zero calls required, or download the self-service £24 DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack instantly:

🟢 Hire FaultyPacket on Fiverr — PHP2Shell CVE-2026-109618 Audit & Fix ($30 / $45 / $65) → ⬇ Buy Instant PHP2Shell & DMARC Pack — £24
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
View All 4 Live Fiverr Gigs (@faultypacket) ↗
TWO SIMPLE WAYS TO FIX IT · £5–£39 INSTANT ZIP OR $15+ DONE-FOR-YOU ON FIVERR 100% Transparent Pricing · Zero Calls Required
⚡ Option 1: Buy on This Website via PayPal (£12–£29 Single Pack · £39 Complete 4-Pack Compliance & Web Shield Bundle)

Instant 0-Second Self-Serve Template ZIP. You immediately download our unencrypted production scripts, MU-plugins, server configs, and templates, and you fill in your own domain name using our 3-minute Quick-Start guide. Lowest flat price because no custom engineer time is required.

🛠️ Option 2: Order on Fiverr ($15–$175 · Basic / Standard / Premium Tiers)

Custom “Done-For-You” 24h Engineering. Why Fiverr costs more: our engineers run a deep external server & DNS probe on your live domain(s) and custom-write every record and config file specifically for your domain, IPs, and mail/payment stack—ready to paste with zero editing. Includes a custom 0–100 Executive HTML Scorecard written for your company, multi-domain tiers (1–5 domains or 25–250 suppliers), live post-fix verification, and all 4 Packs (£84 value) free on Premium.

Gig #1 · Domain DMARC, SPF, DKIM & MTA-STS Audit + DNS Fix Pack£24 Self-Serve ZIP · US$15 / US$30 / US$55 Fiverr

Full RFC 7489/7208/8461 external audit (SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA) + Cloudflare/BIND/M365 DNS Fix ZIP (incl. Google/Yahoo 550 5.7.26 bulk-sender compliance).

⚡ £24 Website ZIP (Self-Serve): Instant download of generic DNS templates, 10-page PDF handbook & Python CLI scanner (you plug in your domain).
🛠️ US$15 / US$30 / US$55 Fiverr (Done-For-You): We audit 1 domain ($25), 3 domains + MTA-STS ($35), or 5 domains + Live Post-Fix Re-Scan + All 4 Packs ($50) & write your exact DNS records + custom Executive HTML Scorecard.
🛠️ Order Done-For-You Custom Audit on Fiverr (US$15 / US$30 / US$55) → ⚡ Or Buy Self-Serve Template ZIP — £24 (Instant PayPal Download)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee

Gig #2 · WP, WooCommerce & PHP2Shell Hardening£12 WP / £24 PHP ZIP · US$15 / US$30 / US$55 Fiverr

Zero-login WordPress/WooCommerce /wp-json/wp/v2/users, xmlrpc.php, PCI-DSS v4.0.1 CSP & wp_mail() 550-5.7.26 rescue + PHP2Shell (CVE-2026-109618) FastCGI/CGI lockdown, MU-plugins & Cloudflare WAF ZIP.

⚡ £12 WP Pack (or £24 PHP Pack) on Website (Self-Serve): Instant 11-file drop-in MU-plugin, Nginx/Apache, Cloudflare WAF & SMTP rescue ZIP (you drop onto your server).
🛠️ US$15 / US$30 / US$55 Fiverr (Done-For-You): We run a live external HTTP/DNS probe on your site, pre-fill your domain’s exact configs & custom Scorecard ($15 1-Site WP/Email · $30 Full WP + PHP2Shell Lockdown · $55 3-Site + Re-Scan + All 4 Packs).
🛠️ Order Done-For-You Custom Fix on Fiverr (US$15 / US$30 / US$55) → ⚡ Or Buy Self-Serve WP Shield ZIP — £12 (Instant PayPal Download)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee

Gig #3 · Cyber Essentials v3.3 (“Danzell”) & Entra ID Pre-Audit£29 Self-Serve ZIP · US$35 / US$55 / US$85 Fiverr

Mandatory April 2026 NCSC/IASME v3.3 gap analysis (cloud MFA anti-spoofing, passwordless readiness, 1-day leaver SLA, Device Code block) + offline Graph PowerShell collector & IASME model answers.

⚡ £29 Website ZIP (Self-Serve): Instant download of our offline Graph PowerShell collector, IASME v3.3 Editable Response Guidance & Templates & 1-Day Leaver SOP.
🛠️ US$35 / US$55 / US$85 Fiverr (Done-For-You): We run your external v3.3 boundary pre-audit ($35 1-Domain · $55 3-Domain + Custom Entra/MFA Plan · $85 5-Domain + Assessor Sign-Off Dossier + All 4 Packs) & write your custom Gap Report.
🛠️ Order Done-For-You Pre-Audit on Fiverr (US$35 / US$55 / US$85) → ⚡ Or Buy Self-Serve CE v3.3 Pack ZIP — £29 (Instant PayPal Download)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee

Gig #4 · NIS2 Art. 21 & DORA 25–250 Supplier Bulk Security Audit£19 Self-Serve CLI · US$50 / US$95 / US$175 Fiverr

Automated non-intrusive posture audit of up to 25, 100, or 250 vendor domains + board-ready HTML Executive Dossier, risk-scored CSV register, 30-day vendor remediation notices & Python CLI scanner.

⚡ £19 Website ZIP (Self-Serve CLI): Instant download of our Python 3 Bulk Supplier CLI Scanner & CSV templates to run vendor scans yourself on your own machine.
🛠️ US$50 / US$95 / US$175 Fiverr (Done-For-You Managed Batch Audit): Send us your vendor list—we scan 25 ($50), 100 ($95), or 250 ($175) supplier domains for you & deliver a finished Art. 21/28 Board HTML Dossier, Risk-Scored CSV + All 4 Packs included.
🛠️ Order Done-For-You 25–250 Vendor Audit on Fiverr (US$50 / US$95 / US$175) → ⚡ Or Buy Self-Serve Bulk CLI Pack — £19 (Instant PayPal Download)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
⚡ 100% Asynchronous Delivery (Zero Meetings Required): All Fiverr gigs and compliance packs are delivered as self-contained, board-ready HTML executive reports + copy-paste DNS/server configs via Fiverr or [email protected]—no sales calls or calendar bloat.
100% FREE FOREVER · NO POPUPS · NO SIGNUPS

Saved you an afternoon of headaches? Buy me a coffee. ☕

I built these scanners and Chrome extensions so you can get instant answers without booking a sales call or handing over your email—if they just saved your day, a coffee keeps the late-night builds going.

☕ Buy Adam a £5.00 Coffee via PayPal →
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
\n
LIVE 30-MINUTE SCRAPED SECURITY & CVE RADAR · SYNCED 2026-10-28 20:32 UTC

Breaking NCSC, CISA, THN, WordPress & PHP Advisories Mapped to Instant UK Domain Fixes

Pre-rendered every 30 minutes from 6 official security feeds (UK NCSC, CISA KEV, The Hacker News, WordPress.org Security, BleepingComputer, PHP.net) for instant search-engine & AI answer-engine indexing. Open the full 12-Advisory UK Threat & CVE Radar → or subscribe via RSS 2.0 Threat Feed (`feed.xml`).

GitHub Security Advisories · CVE-2026-108360 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-108360: [phpoffice/phpspreadsheet] PhpSpreadsheet:… ↗

## Summary PhpSpreadsheet's `Worksheet\Drawing::setPath()` validates an external-image URL against an operator-supplied `isWhitelisted` callback **once**, on the initial URL only, then fetch

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗
GitHub Security Advisories · CVE-2026-108082 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-108082: [symfony/http-foundation] Symfony: ReDoS in… ↗

### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?<!\s)` lookbehind. A run of whitespace placed bef

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗
GitHub Security Advisories · CVE-2026-109413 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-109413: [symfony/symfony] Symfony: Unbounded Recursion… ↗

### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nestin

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗
GitHub Security Advisories · CVE-2026-116675 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-116675: [tinymce] TinyMCE Cross-Site Scripting (XSS)… ↗

### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed bef

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗