SHELLPROOF

Here's what using Shellproof actually looks like. Version check, php.ini audit, fix commands, key scan, wallet check and CSP builder, all in one take on the real site. shellproof.dev

Can someone else spend your tokens? A token delegate can move up to an approved amount without your signature. Shellproof lists every token account with an active delegate, plus the command to revoke it. Read-only. You revoke from your own wallet. shellproof.dev/crypto

Can't patch tonight? Shellproof audits your php.ini or pasted phpinfo() against the PHP2Shell interim mitigations and shows the exact line to change. Mitigations only reduce the risk. Updating PHP is the fix. shellproof.dev/check

PHP2Shell is being exploited right now. It's critical RCE in PHP itself (CVE-2026-109618, CVE-2026-109619), fixed Oct 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We built Shellproof so you can check if you're exposed and fix it without guessing. What's in it: - A version checker. Paste php -v and get a straight answer. - A one-file scanner for your server (shellproof.pyz, any Python 3.8+). It checks the PHP runtime, php.ini, composer.lock, risky code, exposed keys and file integrity. - Fix playbooks with the exact upgrade, restart and verify commands for your platform. Upgrading alone isn't enough if your PHP workers are still running the old code. - Interim mitigations for anyone who can't patch tonight. - Crypto checks. It finds exposed keypairs and seed phrases (masked, never shown), watches a Solana wallet and tells you when it signs a transaction, and lists token approvals so you can revoke the ones you didn't set up. - A CSP builder, so browsers block scripts from hosts you didn't allow even if your PHP server is compromised. Free and MIT licensed, and you can read the source on the site. It all runs on your machine or in your browser. GL51FXf1Qqt9DHHoCRSmNGUH8qnuCPjRRRqnx9Wxpump shellproof.dev