phpinfophpold

📅 October 29, 2026📖 Verified Publication

```html phpinfo.php.old Exposure: Security Risks, Detection & Remediation Playbook

phpinfo.php.old Exposure: Complete Security Playbook for Detection & Remediation

Legacy phpinfo.php.old files lingering on web servers are a silent but critical vulnerability. Attackers routinely scan for these files to extract PHP version numbers, server paths, compiled modules, environment variables, and database credentials hard-coded in scripts. This playbook gives you everything you need to locate, assess, and eliminate phpinfo.php exposure — including old or cached variants.

Key Takeaways

A phpinfo.php.old file leaks the same sensitive data as its current counterpart — PHP version, server API, loaded modules, environment variables, and included paths.
Older PHP versions (below 7.4 and especially below 5.6) are actively unsupported, meaning any phpinfo exposure on those versions is a high-priority vulnerability.
Search-engine caches, Wayback Machine archives, and CDN edge nodes can serve stale phpinfo responses even after the file is deleted.
A single remediation checklist — remove the file, harden .htaccess, disable phpinfo() in production, audit backups, and flush caches.
Automated scanning should run weekly to catch re-emergence from deployments, CI/CD artifacts, or forgotten staging sites.

What Is phpinfo.php.old and Why Does It Matter?

The phpinfo() Function at a Glance

The phpinfo() function outputs a large HTML page containing the complete PHP runtime configuration. Among the exposed data points are:

Exact PHP version and OS build string
Loaded extensions and their version numbers
include_path, doc_root, and open_basedir settings


$_ENV variables (sometimes including API keys and database passwords)
Server software and Apache/Nginx environment headers
Compiled-in module paths used by directory-traversal exploits



How .old Files Appear
phpinfo.php.old files typically result from one or more of these scenarios:

Developers renaming phpinfo.php before replacing it, then forgetting the backup.
Deployment scripts that preserve previous builds as *.old artifacts.
Version-control misconfigurations pushing backup files to the document root.
CMS migration tools leaving diagnostic pages behind in non-public directories.
FTP clients auto-creating file.bak or file.old during transfers.


Risk Assessment: What Attackers Gain from phpinfo.php.old




Exposed Data Point
Exploit Potential
Risk Level




PHP version number
Enables targeted CVE lookups; confirms known-vulnerable release
High


Loaded extensions + versions
Identifies vulnerable plugins (e.g., outdated ImageMagick, OpenSSL)
High


Server API (Apache mod_php, FPM, CGI)
Determines attack surface for handler-based exploits and SSRF
Medium


Document root & include paths
Powers directory traversal, LFI, and RCE attempts
High


$_ENV / $_SERVER variables
May reveal DB credentials, API keys, cloud tokens
Critical


Compiled-in modules (CGI, Suhosin)
Confirms presence or absence of hardening layers
Medium


OS & kernel string
Correlates with OS-level CVEs for privilege escalation
Medium




Detection Checklist: Finding Exposed phpinfo.php.old Files

Phase 1 — On-Server Scan

[ ] Run find /var/www -iname '*phpinfo*' -o -iname '*.php.old' -o -iname '*.php.bak' 2>/dev/null
[ ] Check common deployment roots: public_html, www, htdocs, web
[ ] Search hidden directories: .git, .svn, .archive
[ ] Inspect temporary directories: /tmp, /var/tmp, upload caches
[ ] Run grep -rl 'phpinfo(' /var/www to find all files calling the function
[ ] Audit composer.lock and deployment manifests for stray diagnostic scripts


Phase 2 — External Reconnaissance

[ ] Query site:yourdomain.com phpinfo.php on Google and Bing
[ ] Check the Wayback Machine (web.archive.org) for historical captures
[ ] Use Shodan/Censys to search for phpinfo fingerprints on your IP range
[ ] Run an open-source scanner (Nmap script http-php-info, nuclei templates)
[ ] Verify CDN logs and edge-cache entries for cached phpinfo responses
[ ] Test https://yourdomain.com/phpinfo.php.old and variants from an external IP


Phase 3 — Log Analysis

[ ] Search access logs for GET /phpinfo.php, *.old, *.bak patterns
[ ] Identify source IPs that probed the endpoint — these are likely threat actors
[ ] Cross-reference probe timestamps with firewall and WAF alert logs
[ ] Retain forensic snapshots before any remediation for incident documentation


Remediation Playbook

Step 1 — Immediate Containment

[ ] Delete every phpinfo.php, phpinfo.php.old, and phpinfo.php.bak file found.
[ ] Block the file pattern at the web-server level (see hardening table below).
[ ] Rotate any credentials visible in $_ENV output from the exposed page.
[ ] Document the exposure timeline, accessed IPs, and affected paths.


Step 2 — Web-Server Hardening




Platform
Hardening Rule
Effect




Apache (.htaccess)
<FilesMatch "^phpinfo.*">
Require all denied
</FilesMatch>
Denies direct access to phpinfo and phpinfo.* variants


Apache (.htaccess)
<FilesMatch "\.php\.old$">
Require all denied
</FilesMatch>
Blocks legacy backup PHP files


Nginx (server block)
location ~* ^.*phpinfo { return 404; }
Returns



© 2026 Ahrens Insights. All rights reserved.

Exposed Data Point	Exploit Potential	Risk Level
PHP version number	Enables targeted CVE lookups; confirms known-vulnerable release	High
Loaded extensions + versions	Identifies vulnerable plugins (e.g., outdated ImageMagick, OpenSSL)	High
Server API (Apache mod_php, FPM, CGI)	Determines attack surface for handler-based exploits and SSRF	Medium
Document root & include paths	Powers directory traversal, LFI, and RCE attempts	High
$_ENV / $_SERVER variables	May reveal DB credentials, API keys, cloud tokens	Critical
Compiled-in modules (CGI, Suhosin)	Confirms presence or absence of hardening layers	Medium
OS & kernel string	Correlates with OS-level CVEs for privilege escalation	Medium

Platform	Hardening Rule	Effect
Apache (.htaccess)	`<FilesMatch "^phpinfo.*"> Require all denied </FilesMatch>`	Denies direct access to phpinfo and phpinfo.* variants
Apache (.htaccess)	`<FilesMatch "\.php\.old$"> Require all denied </FilesMatch>`	Blocks legacy backup PHP files
Nginx (server block)	`location ~* ^.*phpinfo { return 404; }`	Returns © 2026 Ahrens Insights. All rights reserved.