[cataphract]

Description

Mitigates the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the appsec extension, for customers running PHP releases older than the upstream fix (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12). Whether it applies to a process is decided by a WAF rule, so it can be switched between block and monitor, or off, from the ruleset.

CVE-2026-109618. On unpatched PHP, a memory_limit error raised while a key is being inserted into a hash table (_zend_hash_str_add_or_update_i) bails out mid-insertion, and request shutdown then walks the half-initialised bucket. Request variables are parsed before any userland runs, so the request alone can reach it; parse_str() and other char *-key builders reach it at runtime.

While the heap is armed, our Zend MM handlers serve every allocation and the engine limit is lifted to a sentinel, so no insertion is abandoned: crossing the soft limit (memory_limit) makes the error pending instead.

• Parse windows. The startup treat_data parse (before RINIT) and request_parse_body() (8.4+) get a window of their own. Once the error is pending, an input_filter wrapper drops later variables, an rfc1867 FILE_START wrapper skips later file parts and a read_post wrapper ends a multipart body; the error is raised as a normal fatal once the arrays are complete. Hard limit: min(max(L, S + k·B + 8 MiB), S + cap), with L upstream's limit (2S, or S + 1 GiB from 1 GiB), B the input bound and k = 6 (11 for multipart).
• Request level (PHP 7.1+). The whole request is armed from the start of appsec's RINIT (with the previous request's WAF decision, reconciled with this request's at the end of RINIT) to the start of its RSHUTDOWN, so appsec's own request-startup work is covered too. A pending error is raised at the next VM interrupt, the way max_execution_time is delivered, but never inside a ddtrace hook closure: the tracer's sandbox would swallow the fatal and the request would run on unprotected. After such a refusal, every allocation asks for the interrupt again until it is raised outside the closure. Hard limit: max(L, S + 8 MiB).
• Above a hard limit the process ends with _exit(137).

Handler lifecycle. Install once at a fixed point, chaining the previous handlers; remove at the mirrored point, only if the slot still holds ours; in between only flags change. That keeps the order LIFO with the profiler's allocation handlers in either module order. When a bailout skips our RSHUTDOWN (or request startup fails), post_deactivate or MSHUTDOWN reset the heap to plain zend_mm. The handlers also put the sentinel back whenever something writes the engine limit directly (e.g. php_error_cb() before every fatal) and follow runtime memory_limit changes. Below 8.4, gc_mem_caches() is wrapped as the profiler does.

CVE-2026-109619. Request-owned engine globals that upstream resets are reset in post_deactivate; the last-error strings are released from a sapi_module.deactivate wrapper; session upload progress is off during the startup POST parse.

Activation by the WAF. Under DD_APPSEC_PHP2SHELL_MITIGATION=auto (the default), an unpatched runtime sends php.php2shell.vulnerable in every request_init: full, or partial when only the minimal fix of the EOL branches is present (zend_mm_safe_error_ex exported, no _femalloc). A patched runtime sends nothing and stays off. PHP 8.6 counts as patched: its first release ships the fix, and only its pre-releases (the 8.6.0RC images CI now uses) lack it.

• The default ruleset carries a rule (dd-php2shell-001, waf module, its own type) matching that address, with a custom non-blocking action (php2shell_mitigation, mode: block|monitor).
• The helper evaluates the address first, in its own run with no timeout (skipped and answered from a cache while the ruleset and the value are unchanged), strips the rule from the normal results (no event, no trace keep, no WAF metrics) and returns the decision none|monitor|block. An unknown mode counts as none.
• The extension keeps the decision per thread: block arms as above; monitor does not arm and only detects native memory errors (zend_error_cb); none does not arm. With no decision yet the process is armed; a request with no WAF answer keeps the last decision. In worker scripts using ddtrace's user-request API (FrankenPHP, RoadRunner, Ratchet) each HTTP request follows its own decision; a disarm with an error pending stays armed until the error is raised.
• on forces the block behaviour on any runtime without asking; off is a hard off.
• A deferred fatal tags the root span _dd.appsec.php2shell.deferred=<phase>; a native memory error seen in monitor mode tags _dd.appsec.php2shell.memory_error and .phase. Both keep the trace.

Gating.

• No hook at all when the configuration at startup rules it out (appsec or the tracer explicitly disabled, mode off, auto on a patched runtime) or under the cli, phpdbg, embed and micro SAPIs, or when memprof or Snuffleupagus is loaded (both replace hooks the mitigation depends on). The mode is read from php-fpm's master: a pool's env[] cannot re-enable what the master ruled out.
• Otherwise it follows the WAF decision (or on), and appsec's own state (RINIT, remote config).
• Two metrics (soft-deferred, tagged with its phase, and hard-exit) are flushed synchronously to the sidecar; that needs two small exports in ext/, in a separate commit.

Compatibility. A review of extensions that use the same engine hooks, and of distro builds, led to a few changes: the deferred fatal bails out explicitly (an error callback that swallows E_ERROR could otherwise return into it on PHP 7.0–7.3); a nested VM interrupt raises a pending error instead of chaining again; the object-store reset runs after every module's post_deactivate (Elastic APM's crashed on release builds); hooks replaced by another extension are reported in the appsec log only; the fatal names the limit actually exceeded. Appsec's own memory-limit restore at request end now falls back to a finite limit instead of leaving the heap unlimited, and in worker scripts ends the worker, as a fixed PHP does. A safety review against EOL-partial engines led to three more: the hard-limit exit records its metric without a log line (a displayed log line could run a user output callback and bail out mid-insertion); every fatal the mitigation raises leaves a finite limit behind, even where php_error_cb's reset would leave none (7.2–7.4.20, 8.0); and every limit restore ends with memory_limit or a finite limit. The remaining interactions are documented in the coverage list.

Release dependency. The first ASM_DD remote-config ruleset replaces the default one, so the backend's rulesets must carry the dd-php2shell-001 rule; without it every process receives none and the mitigation turns off.

Code layout. The code is split by responsibility into compilation units under appsec/src/extension/php2shell/: the out-of-memory guard (handlers, limits, deferral; the allocation hot path stays in this one file), the startup-parse, request_parse_body() and runtime protections, the stale-state resets, the activation policy, monitor detection and span reporting. Each owns its hooks, state, MINFO rows and testing functions. php2shell_mitigation.c is a facade: lifecycle sequencing, the design overview and the coverage list, where the remaining gaps are documented by consequence.

Commits:

1. docs: libc++-21 for the appsec native tests (matches CI).
2. ext: exports so another extension can flush telemetry to the sidecar early.
3. appsec: the mitigation, its tests, and a CI job for the profiler integration test.
4. appsec: WAF-driven activation (address, rule, helper decision, monitor mode, span tags).
5. appsec: review fixes for the activation (FrankenPHP worker mode per HTTP request, per-thread decision, unknown mode).
6. appsec: a worker disarm keeps a pending error; no raise inside the tracer's hook sandbox.
7. appsec: the PHP2Shell tests on fixed and EOL-partial PHP.
8. appsec: two hot-path reads in the guard (heap usage and the engine limit read directly).
9. appsec: compatibility fixes, one commit per decision (memprof/Snuffleupagus/micro off, object-store reset order, explicit bailout, interrupt re-entry, replaced-hook reports, finite restore fallback, breached-limit message, test gates and a CI job on a real EOL-partial engine, docs).
10. appsec: arming from the start of appsec's RINIT, and the fixes from the EOL-partial safety review.

Testing

On amd64:

• Full appsec .phpt suite on the 22 cells of the CI job "test appsec extension" (debug 7.0–8.5, debug-zts 7.0–7.3, debug-zts-asan 7.4–8.5): 0 failures before the last two commits; after them, the PHP2Shell tests on 8.3 debug, 7.1 debug-zts and 8.5 debug-zts-asan.
• Helper unit tests (cargo test, fmt): pass.
• Integration (Php2ShellMitigationTests, Php2ShellProfilerTests with -PwithProfiler) on 8.3 and 8.5, both on the vulnerable images this branch pins and on the fixed images master now pins (8.3.36, 8.5.12): all pass, skips only where expected. FrankenPHP 8.4 ZTS (worker and classic classes, Php2ShellFrankenphpWorkerTests): pass, including a decision switched block → monitor → block on one worker and a disarm with an error pending.
• EOL minimal fix: the .phpt suite through the integration images on PHP 7.1 with php-src 1d7dec178 backported, and on stock 7.1.
• Lint (clang-format/clang-tidy 21.1.8) clean; Alpine/musl GCC -O2 -Werror builds on 7.0 and 8.3.
• After the compatibility commits: the full .phpt suite on 7.0, 7.1-zts, 7.3, 7.4-zts-asan, 8.1, 8.3, 8.4-zts-asan and 8.5-zts-asan; integration on the vulnerable, fixed and 7.1 EOL-partial images (on the last, six memory-limit tests from master fail as they do on master); each commit builds and passes the PHP2Shell tests on its own. The same matrix, plus 8.0 and the jammy EOL-partial job, after the RINIT and safety-review commits.
• Red/green: each regression test added during review failed on the code before its fix and passed after it, e.g. the FrankenPHP worker cases, the hook-sandbox .phpt and the helper's unknown-mode test.

🤖 Generated with Claude Code

[datadog-prod-us1-4]

 

⚠️ Warnings

Your PR has warnings. Please review the issues below.

❄️ 1 New flaky test detected

e_waf_activation: under auto, the PHP2Shell rule of the ruleset decides block, monitor or off() from com.datadog.appsec.php.integration.Php2ShellMitigationTests

hp?alloc=58720256), (http.method, GET), (span.kind, server), (http.useragent, Java-http-client/17.0.20.1), (error.type, E_ERROR), (error.message, Allowed memory size of 33554432 bytes exhausted (tried to allocate 58720288 bytes)), (error.stack, #0 /var/www/public/php2shell_runtime_oom.php(9): str_repeat()
#1 {main}), (_dd.appsec.s.req.cookies, [[],{"len":0}]), (_dd.appsec.fp.http.header, hdr-0100000000-d1d7834f-3-c81f0d70), (_dd.appsec.fp.http.endpoint, http-get-750a29c5-bcd3b184-), (_dd.appsec.s.res.headers, [{"x-powered-by":[[[8]],{"len":1}]}]), (_dd.appsec.s.req.params, [[[8]],{"len":1}]), (_dd.appsec.s.req.body, [[],{"len":0}]), (_dd.appsec.s.req.headers, [{"upgrade":[8],"user-agent":[8],"connection":[8],"host":[8],"http2-settings":[8],"x-datadog-trace-id":[8]}]), (_dd.appsec.fp.http.network, net-0-0000000000), (_dd.appsec.s.req.query, [{"alloc":[8]}]), (_dd.appsec.event_rules.version, 1.18.0), (_dd.runtime_family, php), (http.client_ip, 192.168.0.1), (http.request.headers.user-agent, Java-http-client/17.0.20.1), (http.endpoint, /{param:str}), (_dd.p.ksr, 1), (_dd.p.dm, -1), (http.status_code, 500), (env, integr. Expression: log1.contains(Allowed memory size of $WAF_LIMIT bytes exhausted ($DEFERRED_SUFFIX)

java.lang.AssertionError: expected the deferred fatal; got: [31-Oct-2026 11:54:23 UTC] PHP Fatal error:  Allowed memory size of 33554432 bytes exhausted (tried to allocate 58720288 bytes) in /var/www/public/php2shell_runtime_oom.php on line 9
[31-Oct-2026 11:54:23 UTC] [ddtrace] [span] [753] Encoding span: Span { service: appsec_int_tests, name: web.request, resource: GET /php2shell_runtime_oom.php, type: web, trace_id: 12200891684856157375, span_id: 15076670652330072093, parent_id: 0, start: 1793447663419911022, duration: 3022727, error: 1, meta: VecMap { data: [(_dd.sdk.otlp_export, false), (runtime-id, f5e6ffb2-6c09-4e1f-b4de-c0f2b54feb69), (http.url, http://docker:32774/php2shell_runtime_oom.php?alloc=58720256), (http.method, GET), (span.kind, server), (http.useragent, Java-http-client/17.0.20.1), (error.type, E_ERROR), (error.message, Allowed memory size of 33554432 bytes exhausted (tried to allocate 58720288 bytes)), (error.stack, #0 /var/www/public/php2shell_runtime_oom.php(9): str_repeat()
#1 {main}), (_dd.appsec.s.req.cookies, [[],{"len":0}]), (_dd.appsec.fp.http.header, hdr-0100000000-d1d7834f-3-c81f0d70), (_dd.appsec.fp.http.endpoint, http-get-750a29c5-bcd3b184-), (_dd.appsec.s.res.headers, [{"x-powered-by":[[[8]],{"len":1}]}]), (_dd.appsec.s.req.params, [[[8]],{"len":1}]), (_dd.appsec.s.req.body, [[],{"len":0}]), (_dd.appsec.s.req.headers, [{"upgrade":[8],"user-agent":[8],"connection":[8],"host":[8],"http2-settings":[8],"x-datadog-trace-id":[8]}]), (_dd.appsec.fp.http.network, net-0-0000000000), (_dd.appsec.s.req.query, [{"alloc":[8]}]), (_dd.appsec.event_rules.version, 1.18.0), (_dd.runtime_family, php), (http.client_ip, 192.168.0.1), (http.request.headers.user-agent, Java-http-client/17.0.20.1), (http.endpoint, /{param:str}), (_dd.p.ksr, 1), (_dd.p.dm, -1), (http.status_code, 500), (env, integr. Expression: log1.contains(Allowed memory size of $WAF_LIMIT bytes exhausted ($DEFERRED_SUFFIX)
	at org.codehaus.groovy.runtime.InvokerHelper.createAssertError(InvokerHelper.java:416)
	at com.datadog.appsec.php.integration.Php2ShellMitigationTests$_e_waf_activation__under_auto,_the_PHP2Shell_rule_of_the_ruleset_decides_block,_monitor_or_off_closure5.doCall(Php2ShellMitigationTests.groovy:272)
	at com.datadog.appsec.php.integration.Php2ShellMitigationTests$_e_waf_activation__under_auto,_the_PHP2Shell_rule_of_the_ruleset_decides_block,_monitor_or_off_closure5.doCall(Php2ShellMitigationTests.groovy)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
...

View in Flaky Test Management

ℹ️ Info

No other issues found (see more)

🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 79.15%
• Overall Coverage: 66.09% (-10.56%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 105da59 | Docs | View more details | Give us feedback!}

[pr-commenter]

Benchmarks [ appsec ]

Benchmark execution time: 2026-11-03 13:33:02

Comparing candidate commit f9adaa5 in PR branch glopes/appsec-oom-soft-limit with baseline commit aae7184 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 2 performance regressions! Performance is the same for 10 metrics, 0 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:LaravelBench/benchLaravelOverhead-appsec

• 🟥 execution_time [+458.625µs; +714.475µs] or [+3.340%; +5.204%]

scenario:WordPressBench/benchWordPressOverhead-appsec

• 🟥 execution_time [+1.749ms; +2.019ms] or [+5.239%; +6.046%]

[bwoebi]

Fwiw: this does nothing if has_prev, and the profiler does install its own forwarding handlers.

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2026-11-03 14:20:53

Comparing candidate commit f9adaa5 in PR branch glopes/appsec-oom-soft-limit with baseline commit aae7184 in branch master.

📊 Benchmarking dashboard

Found 1 performance improvements and 2 performance regressions! Performance is the same for 190 metrics, 1 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:ComposerTelemetryBench/benchTelemetryParsing-opcache

• 🟩 execution_time [-1.842µs; -0.358µs] or [-10.466%; -2.034%]

scenario:SamplingRuleMatchingBench/benchRegexMatching1

• 🟥 execution_time [+54.777ns; +128.623ns] or [+3.649%; +8.568%]

scenario:SamplingRuleMatchingBench/benchRegexMatching4

• 🟥 execution_time [+53.805ns; +98.995ns] or [+3.627%; +6.673%]

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:LaravelBench/benchLaravelDdprof-opcache

• unstable execution_time [-236.119µs; +1474.319µs] or [-1.538%; +9.605%]

[bwoebi]

Is there a specific reason you went with an attempt at emulating the full fix partially, rather than just going with the emulation of the minimal fix?
php/php-src@1d7dec1

With the way you emulated it, it's not possible to get an OOM during input parsing, but it does not prevent any delayed OOM, e.g. bringing heap size to 127.9M and then just nudging it over the limit at a controlled place (like an array operation in runtime code - e.g. if you simply have a wordpress installation, an attack can just whitebox that).

[Copilot]

🟡 Changes recommended

Critical request-lifecycle defects can prevent later FrankenPHP traces from being force-kept and leave dangling request-heap pointers after failed startup.

2 open issues

• Reset the ASM-event latch for each worker HTTP request · New
• Avoid caching request-heap strings before startup can fail · New

What changed in this PR

Adds WAF-controlled PHP2Shell mitigation for vulnerable PHP runtimes, integrating memory-error deferral, request-state cleanup, telemetry, and trace reporting into AppSec.

Changes:

• Adds mitigation configuration, runtime vulnerability signaling, and WAF-driven activation.
• Integrates request lifecycle protection, monitoring, span tags, and early telemetry exports.
• Adds regression fixtures, worker and profiler integration coverage, and CI documentation updates.

This pull request requires changes. Two critical issues remain:

• Critical — appsec/src/extension/request_lifecycle.c:641: Reset the ASM-emission latch before evaluating each worker HTTP request’s WAF data. Otherwise, a previous request’s WAF event prevents later PHP2Shell reporting from force-keeping the correct trace.
• Critical — ext/sidecar.c:995: Early application registration retains request-heap service and environment strings in tracer globals. Failed startup can bypass their cleanup, leaving dangling pointers released during the next request. Avoid populating these caches on the early path or clear them during failed-startup teardown.

File	Description
zend_abstract_interface/​alloc.h	Detects the EOL minimal-fix symbol.
metadata/​supported-configurations.json	Registers the mitigation configuration.
ext/​telemetry.h	Declares the public telemetry flush API.
ext/​telemetry.c	Exports the telemetry flush implementation.
ext/​sidecar.h	Declares early application registration.
ext/​sidecar.c	Implements early application registration.
ddtrace-extension.sym	Exposes both new tracer APIs.
appsec/​tests/​integration/​src/​test/​www/​frankenphp/​run.sh	Configures worker mitigation tests.
appsec/​tests/​integration/​src/​test/​www/​frankenphp/​public/​index.php	Registers worker test endpoints.
appsec/​tests/​integration/​src/​test/​www/​base/​public/​php2shell_sink.php	Reports startup parsing and memory usage.
appsec/​tests/​integration/​src/​test/​www/​base/​public/​php2shell_runtime.php	Drives runtime parsing scenarios.
appsec/​tests/​integration/​src/​test/​www/​base/​public/​php2shell_runtime_oom.php	Drives runtime allocation failures.
appsec/​tests/​integration/​src/​test/​www/​_handlers/​src/​Php2ShellWorkerHandler.php	Reports worker identity and memory.
appsec/​tests/​integration/​src/​test/​www/​_handlers/​src/​Php2ShellOomHandler.php	Triggers worker allocation failures.
appsec/​tests/​integration/​src/​test/​www/​_handlers/​src/​Php2ShellHoldHandler.php	Retains memory across worker requests.
appsec/​tests/​integration/​src/​test/​bin/​enable_extensions.sh	Enables profiler allocation hooks.
appsec/​tests/​integration/​src/​main/​groovy/​com/​datadog/​appsec/​php/​docker/​PhpFpm.groovy	Supports capturing profiler startup logs.
appsec/​tests/​integration/​src/​main/​groovy/​com/​datadog/​appsec/​php/​docker/​AppSecContainer.groovy	Mounts and enables profiler artifacts.
appsec/​tests/​integration/​scripts/​prepare-rust-libc-compat.sh	Prepares AArch64 profiler ABI compatibility.
appsec/​tests/​extension/​php2shell_mitigation_waf_sticky.phpt	Tests decisions across successive requests.
appsec/​tests/​extension/​php2shell_mitigation_waf_startup_parse.phpt	Tests startup parsing under each policy.
appsec/​tests/​extension/​php2shell_mitigation_waf_runtime.phpt	Tests runtime policy and span tags.
appsec/​tests/​extension/​php2shell_mitigation_waf_request_parse_body.phpt	Tests body-parsing policy and tags.
appsec/​tests/​extension/​php2shell_mitigation_waf_no_answer.phpt	Tests missing answers and AppSec gating.
appsec/​tests/​extension/​php2shell_mitigation_waf_monitor_out_of_memory.phpt	Tests monitoring of OS allocation failures.
appsec/​tests/​extension/​php2shell_mitigation_waf_monitor_module_rinit.phpt	Tests monitoring during module initialization.
appsec/​tests/​extension/​php2shell_mitigation_waf_monitor_after_arming.phpt	Tests monitor decisions after request arming.
appsec/​tests/​extension/​php2shell_mitigation_waf_decisions.phpt	Tests decision replacement and preservation.
appsec/​tests/​extension/​php2shell_mitigation_waf_address.phpt	Tests vulnerability address emission.
appsec/​tests/​extension/​php2shell_mitigation_use_zend_alloc_0.phpt	Tests operation without Zend MM accounting.
appsec/​tests/​extension/​php2shell_mitigation_status.phpt	Tests status and hook reporting.
appsec/​tests/​extension/​php2shell_mitigation_sapi_off.phpt	Tests excluded SAPIs against CGI behavior.
appsec/​tests/​extension/​php2shell_mitigation_sapi_deactivate_clear_last_error.phpt	Tests clearing late last-error state.
appsec/​tests/​extension/​php2shell_mitigation_runtime_php70.phpt	Tests PHP 7.0 runtime limitations.
appsec/​tests/​extension/​php2shell_mitigation_runtime_pending_dropped.phpt	Tests pending-error cleanup at request end.
appsec/​tests/​extension/​php2shell_mitigation_runtime_parse_str.phpt	Tests runtime parse_str() deferral.
appsec/​tests/​extension/​php2shell_mitigation_runtime_hard_limit.phpt	Tests runtime hard-limit enforcement.
appsec/​tests/​extension/​php2shell_mitigation_rinit_after_failed_startup.phpt	Tests configuration after failed startup.
appsec/​tests/​extension/​php2shell_mitigation_rfc1867_off.phpt	Tests upload progress with mitigation disabled.
appsec/​tests/​extension/​php2shell_mitigation_request_parse_body.phpt	Tests deferred body-parsing failures.
appsec/​tests/​extension/​php2shell_mitigation_request_parse_body_os_refusal.phpt	Tests finite limits after parsing bailouts.
appsec/​tests/​extension/​php2shell_mitigation_request_parse_body_no_user_code.phpt	Tests suppression of parsing callbacks.
appsec/​tests/​extension/​php2shell_mitigation_post_deactivate_reset.phpt	Tests request-owned engine-global resets.
appsec/​tests/​extension/​php2shell_mitigation_post_deactivate_hook.phpt	Tests reset lifecycle and gating.
appsec/​tests/​extension/​php2shell_mitigation_patched_detection.phpt	Checks detection against fixed releases.
appsec/​tests/​extension/​php2shell_mitigation_oom_cgi.phpt	Tests calibrated startup parsing failures.
appsec/​tests/​extension/​php2shell_mitigation_on.phpt	Tests forced activation.
appsec/​tests/​extension/​php2shell_mitigation_off.phpt	Tests explicit deactivation.
appsec/​tests/​extension/​php2shell_mitigation_multipart_header_lines.phpt	Tests stopping oversized multipart headers.
appsec/​tests/​extension/​php2shell_mitigation_multipart_header_lines_rpb.phpt	Tests multipart header stopping at runtime.
appsec/​tests/​extension/​php2shell_mitigation_multipart_files_after_crossing.phpt	Tests multipart parts after limit crossing.
appsec/​tests/​extension/​php2shell_mitigation_multipart_file_part_name.phpt	Tests startup multipart name headroom.
appsec/​tests/​extension/​php2shell_mitigation_multipart_file_part_name_rpb.phpt	Tests runtime multipart name headroom.
appsec/​tests/​extension/​php2shell_mitigation_minfo.phpt	Tests mitigation information rows.
appsec/​tests/​extension/​php2shell_mitigation_memory_limit_below_chunk.phpt	Tests limits below Zend chunk size.
appsec/​tests/​extension/​php2shell_mitigation_interrupt_chain.phpt	Tests chaining of interrupt handlers.
appsec/​tests/​extension/​php2shell_mitigation_input_filter_parse_str.phpt	Tests filter rewriting and null lengths.
appsec/​tests/​extension/​php2shell_mitigation_input_filter_off.phpt	Tests filtering while mitigation is disabled.
appsec/​tests/​extension/​php2shell_mitigation_input_filter_displaced_drop.phpt	Tests dropped-variable forwarding behavior.
appsec/​tests/​extension/​php2shell_mitigation_hook_sandbox.phpt	Tests deferral outside tracer sandboxes.
appsec/​tests/​extension/​php2shell_mitigation_hook_error_cb_opcache.phpt	Tests error-hook ordering with OPcache.
appsec/​tests/​extension/​php2shell_mitigation_hook_displaced_opcache_preload.phpt	Tests temporary preload hook displacement.
appsec/​tests/​extension/​php2shell_mitigation_hook_displaced_after_startup.phpt	Tests displaced-hook reporting and behavior.
appsec/​tests/​extension/​php2shell_mitigation_hard_limit_post_max_size.phpt	Tests input-bound parsing headroom.
appsec/​tests/​extension/​php2shell_mitigation_hard_limit_post_max_size_user_ini.phpt	Tests bounds after .user.ini changes.
appsec/​tests/​extension/​php2shell_mitigation_gc_mem_caches.phpt	Tests garbage collection while armed.
appsec/​tests/​extension/​php2shell_mitigation_gated_disabled.phpt	Tests startup AppSec-disable gating.
appsec/​tests/​extension/​php2shell_mitigation_gated_disabled_upload_progress.phpt	Tests upload progress with AppSec disabled.
appsec/​tests/​extension/​php2shell_mitigation_gate_trace_disabled_startup.phpt	Tests startup tracer-disable gating.
appsec/​tests/​extension/​php2shell_mitigation_gate_rinit_disabled.phpt	Tests request-time disable gating.
appsec/​tests/​extension/​php2shell_mitigation_gate_remcfg_follow.phpt	Tests remote-config activation gating.
appsec/​tests/​extension/​php2shell_mitigation_gate_fcgi_env_enabled.phpt	Tests startup disable remaining final.
appsec/​tests/​extension/​php2shell_mitigation_filter_default_warning.phpt	Tests expanding-filter warnings.
appsec/​tests/​extension/​php2shell_mitigation_deferred_warning_limit.phpt	Tests finite limits during warning callbacks.
appsec/​tests/​extension/​php2shell_mitigation_deferral_not_carried_over.phpt	Tests deferral isolation between requests.
appsec/​tests/​extension/​p2s_stub/​CMakeLists.txt	Builds the test-only extension.
appsec/​tests/​extension/​inc/​php2shell_user_ini/​child.php	Reports effective per-directory limits.
appsec/​tests/​extension/​inc/​php2shell_user_ini/​.user.ini	Lowers the fixture’s POST bound.
appsec/​tests/​extension/​inc/​php2shell_child.php	Reports request status and parsed variables.
appsec/​tests/​extension/​inc/​php2shell_child_waf.php	Reports memory-error span tags.
appsec/​tests/​extension/​inc/​php2shell_child_waf_helper.php	Drives mock WAF decision exchanges.
appsec/​tests/​extension/​inc/​php2shell_child_status.php	Reports soft and hard limits.
appsec/​tests/​extension/​inc/​php2shell_child_runtime_parse_str.php	Drives calibrated runtime string parsing.
appsec/​tests/​extension/​inc/​php2shell_child_runtime_alloc.php	Drives allocation and shutdown scenarios.
appsec/​tests/​extension/​inc/​php2shell_child_rpb.php	Drives body parsing with options.
appsec/​tests/​extension/​inc/​php2shell_child_rpb_os_refusal.php	Forces OS refusal during body parsing.
appsec/​tests/​extension/​inc/​php2shell_child_rpb_ob_callback.php	Allocates from deferred-warning output callbacks.
appsec/​tests/​extension/​inc/​php2shell_child_rpb_no_user_code.php	Tracks error and session callbacks.
appsec/​tests/​extension/​inc/​php2shell_child_rpb_filter.php	Reports filter storage after deferral.
appsec/​tests/​extension/​inc/​php2shell_child_pending_dropped.php	Leaves an error pending at script end.
appsec/​tests/​extension/​inc/​php2shell_child_parse_str_filter.php	Reports string and environment filtering.
appsec/​tests/​extension/​inc/​php2shell_child_minimal.php	Exercises sub-chunk memory limits.
appsec/​tests/​extension/​inc/​php2shell_child_minfo.php	Reports SAPI and hook installation.
appsec/​tests/​extension/​inc/​php2shell_child_interrupt_chain.php	Exercises signal-handler interrupt chaining.
appsec/​tests/​extension/​inc/​php2shell_child_hook_sandbox.php	Crosses limits inside a tracer hook.
appsec/​tests/​extension/​inc/​php2shell_child_gc_mem_caches.php	Exercises armed garbage collection.
appsec/​tests/​extension/​inc/​php2shell_child_filter_input.php	Reports raw and filtered request values.
appsec/​tests/​extension/​inc/​php2shell_child_filter_count.php	Checks filter storage consistency.
appsec/​tests/​extension/​inc/​php2shell_child_carry_over.php	Exercises consecutive-request deferral isolation.
appsec/​src/​extension/​request_lifecycle.c	Applies remote-config and worker-request policy.
appsec/​src/​extension/​php2shell/​p2s_startup_parse.h	Defines startup parsing interfaces.
appsec/​src/​extension/​php2shell/​p2s_stale_state.h	Defines stale-state cleanup interfaces.
appsec/​src/​extension/​php2shell/​p2s_runtime.h	Defines request-level protection interfaces.
appsec/​src/​extension/​php2shell/​p2s_request_parse_body.h	Defines body-parsing hook interfaces.
appsec/​src/​extension/​php2shell/​p2s_report.h	Defines memory-error reporting interfaces.
appsec/​src/​extension/​php2shell/​p2s_report.c	Adds span tags and trace-retention requests.
appsec/​src/​extension/​php2shell/​p2s_policy.h	Defines activation and WAF decision policy.
appsec/​src/​extension/​php2shell/​p2s_monitor.h	Defines native-error monitoring interfaces.
appsec/​src/​extension/​php_compat.h	Adds older-PHP handler-type compatibility.
appsec/​src/​extension/​ddtrace.h	Declares resolved early telemetry APIs.
appsec/​src/​extension/​ddtrace.c	Resolves the new tracer exports.
appsec/​src/​extension/​ddappsec.h	Declares once-guarded configuration refresh.
appsec/​src/​extension/​ddappsec.c	Integrates mitigation lifecycle and status.
appsec/​src/​extension/​configuration.h	Declares mitigation settings and disable checks.
appsec/​src/​extension/​configuration.c	Implements explicit-disable checks.
appsec/​src/​extension/​commands/​request_init.c	Sends the vulnerability address to WAF.
appsec/​src/​extension/​commands_helpers.c	Processes returned mitigation decisions.
appsec/​recommended.json	Adds the default mitigation rule and action.
appsec/​helper-rust/​src/​service/​updateable_waf.rs	Assigns unique WAF build generations.
appsec/​helper-rust/​src/​service.rs	Pairs request contexts with generations.
appsec/​helper-rust/​src/​client/​protocol.rs	Tests decision response serialization.
appsec/​cmake/​run_tests.cmake	Adds the test extension dependency.
.gitlab/​generate-appsec.php	Adds profiler integration CI coverage.
.claude/​ci/​appsec-native-tests.md	Updates documented native-test toolchain versions.

_{Review effort: Balanced}