# PHP2Shell on AWS: response kit

Companion files for [PHP2Shell on AWS: Start on October 17, and Mind the 8 KB WAF Gap](https://www.factualminds.com/blog/php2shell-aws-waf-8kb-gap-2026/). Written 2026-10-27.

| File | What it does |
| --- | --- |
| `find-php-on-aws.sh` | Read-only AWS CLI sweep across Regions: SSM Inventory `php*` packages, Elastic Beanstalk PHP environments, Lambda custom-runtime and image functions, Lightsail PHP blueprints, Inspector findings for both CVEs. |
| `waf-count-rules.json` | Two AWS WAF rules in **Count** mode. The first follows the three conditions of the bulletin's custom rule as Classmethod published it (POST, `PHPSESSID`, `PHP_SESSION_UPLOAD_PROGRESS`). The second counts bodies over 8,192 bytes so you can see what a size block would stop. |
| `checklist.md` | Find, patch, interim WAF, look back from 2026-10-17, close. |

## Run the sweep

```bash
chmod +x find-php-on-aws.sh
./find-php-on-aws.sh                       # all enabled Regions
REGIONS="us-east-1" ./find-php-on-aws.sh   # one Region
```

Expected output is one `== region` header per Region, followed by `[label]` lines for each hit, or `SKIP:` lines where a service is unavailable or access is denied.

## Check the WAF rules before you add them

```bash
aws wafv2 check-capacity --scope REGIONAL --rules file://waf-count-rules.json
```

Add the rules to an existing web ACL through the console or your IaC. Do not replace the web ACL. The rules ship in Count mode. Change an action to Block only after reading the counts.

These rules are ours. They follow the published bulletin rule but are not AWS's file. We have not run them against production traffic.