[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO81P4BfeOHgWf8z9zRFM6qG8qCqfa6kbgUfq_7jX6w0":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"a31d7169-13df-4fb1-8d5d-cd35afb0caf1","Discover and remediate PHP2Shell exposure with Tenable","discover-and-remediate-php2shell-exposure-with-tenable-1bd1c7","Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they’re affected and update PHP to fixed versions. Tenable helps you find PHP2Shell across your attack surface. Tenable One Attack Surface Management discovers externally facing PHP assets. Tenable One Vulnerability Management and Tenable Security Center provide detections, including local checks for Linux distribution packages. Tenable One Web App Scanning assesses web applications, and Tenable One Cloud Exposure covers cloud workloads. Tenable accelerates remediation. Tenable Patch Management matches exposures to the right patches, launches patch workflows, and validates fixes with post-scan checks. Tenable One with Tenable Hexa AI lets you find vulnerable assets, create exposure initiatives, and generate remediation tickets with simple prompts. Respond faster with Tenable solutions The recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have put security teams in a race against attackers to remediate or mitigate exposure before their systems are targeted. PHP runs on more than 70% of websites, and many of those sites run unsupported, legacy branches that no longer receive upstream support. Organizations need to quickly find where they’re affected and update PHP to fixed versions. To help cybersecurity teams accelerate emergency response, this blog outlines tips for using the Tenable solutions to identify vulnerable versions of PHP, prioritize remediation decisions, and implement patches as quickly as possible. External Attack Surface Management Tenable One Attack Surface Management (ASM) helps you discover externally facing assets running PHP. ASM continuously scans public data sources, such as DNS records, IP addresses, Autonomous System Numbers (ASN), WHOIS registrations, and neighboring IP ranges, to discover forgotten, rogue, or shadow IT assets that might be vulnerable to PHP2Shell. This is one of the first steps to take. It shows your digital footprint from the attacker’s perspective and identifies potential entry points into your organization. Important ASM tips include: Use ASM to find additional top-level domains related to your organization. Suggested Domains helps you identify additional domains you may own based on ASN, brand, domain name, IP range, subdomain, or nameserver. You can also adjust the suggestion rules to prioritize domain names based on the likelihood of ownership. Search the inventory for PHP deployments. Create a query in ASM to identify PHP as a programming language filter. This gives you a quick starting point to assess locations, asset details, and software versions for further analysis. Continuously monitor for changes in your attack surface. Use Subscriptions in ASM to receive event-driven notifications and understand important changes in your attack surface that may create new exposure. Choose from hundreds of pre-built event categories or create a customized subscription. Two subscriptions apply to PHP: PHP in applications and PHP end-of-life installs. Explore the solution walk-through to learn more about Tenable One Attack Surface Management. How to Identify and Tag PHP Assets in Tenable One Attack Surface Management. This demo shows how to get a view of the external attack surface and identify where php2shell creates exposure. In Explore > Asset Inventory, review the inventory of assets facing the outside world. To add another inventory source, click '+' and choose an option from the drop-down menu, such as 'Add Hostnames or Domains.' In the pop-up menu, enter a new hostname, for example 'tenable.com.' To narrow the results to assets running PHP, use the query bar to set 'Programming Language' equal to 'PHP.' The results show 265 assets with PHP listed as their Programming Language. Create a 'PHP2Shell' tag and apply it to the selected assets so they can be grouped and prioritized. The Tags column then displays the 'PHP2Shell' tag. Subscriptions can be used to view and assess PHP. Subscriptions provide a growing list of events, including predefined lists and categories. Search for 'PHP' and add the 'PHP - v1' subscription. After subscribing, create an alert for the subscription. The subscription is set to 'Programming Language' contains php, so it filters assets and sends an alert when a new asset meeting this criteria is identified. Vulnerability Management Tenable One Vulnerability Management and Tenable Security Center both help you find PHP2Shell vulnerabilities with detections for PHP, including local checks for PHP packages from Linux distributions. Tenable will release additional detections as vendors publish fixes in their security advisories. Both solutions help you create out-of-band, tactical scans based on your preferred scan policy. Additional tips include: Update plugin feeds before running a scan. Tenable One Vulnerability Management automatically manages and updates plugin feeds through cloud synchronization by default. In offline or air-gapped environments, Tenable Security Center may require manual plugin feed updates. Use thorough testing to discover more vulnerabilities. Enabling thorough testing and paranoia mode in your scan policy conducts deeper assessments of your attack surface using multiple methods to discover risk. This is very important when you need to scan software across all system drives or investigate deep component-level software vulnerabilities where default settings may result in false negatives. Assign tags to indicate exposure. Use dynamic tagging to identify PHP2Shell on existing and newly discovered assets. Actively manage open remediations. Use Exposure Response in Tenable One Vulnerability Management to create Jira tickets or ServiceNow incidents and monitor remediation progress. Check out these solution walk-throughs to learn more about Tenable One Vulnerability Management and Tenable Security Center: How to Identify and Address PHP2Shell Vulnerabilities in Tenable Security Center. This demo shows how to assess and remediate disclosed PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619). Start the investigation by searching the complete asset inventory for potential vulnerabilities. Construct an advanced query to filter for specific known PHP-related CVEs affecting the environment. Review the IP Summary to understand the overall vulnerability posture of affected hosts with known CVEs. Use specific Tenable Plugin IDs for PHP-related vulnerabilities to uncover detailed findings across all assets. Next steps: set up a pre-configured or custom report and\u002For dashboard to assess the impact of PHP-related vulnerabilities across the environment. Web App Scanning Tenable One Web App Scanning (WAS) can help you assess your web applications for the presence of PHP2Shell, especially where PHP is embedded in content management systems (CMS), databases, and session management platforms. WAS crawls across modern web applications and APIs to identify OWASP Top 10 risks and web app component vulnerabilities. It inspects components, HTTP headers, server signatures, and cookies looking for PHP versions and associated vulnerabilities. Tips for using WAS include: Standard WAS scan policies will discover PHP2Shell vulnerabilities. No need to create a customized policy as long as you select all plugin groups in your scan setup. WAS assessments take longer than traditional vulnerability management scans because WAS analyzes web frameworks and responses in more depth. Incorporate ASM results into new WAS assessments. WAS scans need known web app targets to point the scanner to assess risk. Use ASM findings to discover previously unknown web apps so that you can add them into your assessment scope. Filter on CVEs to find results. In the Findings page, you can apply filters to see where you are exposed. Generate reports and export results to easily send to application owners and remediation teams to fix. See the solution walk-through to learn more about Tenable One Web App Scanning. Patch Management Tenable Patch Management can help you accelerate patching by matching asset and exposure findings to the patches you need to apply. You can launch patch workflows directly from Tenable One Vulnerability Management and Tenable Security Center to define the right patch strategy based on your organization’s requirements. Tenable Patch Management enables autonomous patching, safety controls and rollbacks, and automated post-scan validation to ensure exposures have been closed. Important Tenable Patch Management tips include: Customize your patching strategy to address emergency vulnerabilities. Define patching schedules, deployment plans, and automation levels to address PHP2Shell and other critical out-of-band remediations. Verify patch implementation with remediation scans. Use remediation scans to confirm patches are installed and PHP2Shell vulnerabilities are marked as fixed. You can also see the latest patch information in the plugin output. Automatically correlate patches to vulnerable versions of PHP. Mapping patches to vulnerabilities by hand is time-consuming and error-prone. Tenable Patch Management finds the right patches for you automatically, pulling updates from official OS and third-party vendor repositories within 48 hours of release. Browse the solution walk-through to learn more about Tenable Patch Management. Cloud Security Tenable One Cloud Exposure can help you find PHP2Shell vulnerabilities in cloud workloads using agent and agentless scanning, configuration auditing, and container inspection. Just as you would use of Tenable One Vulnerability Management, Tenable Security Center, and Tenable One Web App Scanning to address vulnerabilities in on-premises and self-managed hosts, Tenable One Cloud Exposure helps you manage and remediate vulnerabilities in Amazon Web Services, Microsoft Azure, and Google Cloud Platform environments. Tips for using Tenable One Cloud Exposure include: Detect PHP2Shell in the Emerging Threats view. Click on the Risk tab to see the Emerging Threats page that shows all PHP2Shell vulnerabilities in one view. Toggle between virtual machines, virtual machine images, and container images to see impacted resources. This shows which resources are affected, so you can triage issues and accelerate remediation workflows. Create a policy to detect and respond to PHP2Shell vulnerabilities. Create a response playbook based on you business rules and preferences. Custom policies enable you to define rules, schedule reports, and create step-by-step remediation guides to fix issues immediately. Leverage integrated remediation workflows. For Infrastructure as Code (IaC) environments, use auto-generated IaC snippets supporting Terraform, CloudFormation, and JSON to push code-level corrections straight to your repositories. Otherwise, you can route service tickets into your existing IT and DevOps workflows to automate processes. View the solution walk-through to learn more about Tenable One Cloud Exposure. How to address PHP2Shell in Tenable One Cloud Exposure. This demo covers using Hexa, the PHP2Shell Emerging Threats dashboard, Explorer queries, custom policies, custom dashboards, scheduled reports, and risk automations to identify, track, and remediate PHP2Shell exposures. Orientation with Hexa: Ask Hexa orientation questions such as \"how can PHP2Shell be exploited in my infrastructure?\" Hexa returns a summary of what PHP2Shell does, how an attacker might attempt to exploit it, and recommended next steps for exposures found in the environment. Exploitation paths vary. PHP2Shell Dashboard: Navigate to Risk in the left navigation, then Emerging Threats, then PHP2Shell. The dashboard gives an end-to-end view of resources affected by PHP2Shell. Filter by infrastructure type, such as Container Images, Virtual Machines, and Virtual Machine Images. Use filters and Group By options to organize the data to fit how a team operates. To drill down, click the Vulnerability column for the first affected container image under the Container Registry account. Its properties can be reviewed to prioritize remediation and close exposures before exploitation. Under the Overview tab, the Plugins section lists Plugin ID 369483, which contains CVE-2026-109618. Clicking the plugin ID shows plugin details for the container image carrying the critical PHP2Shell CVE, along with remediation instructions. Remediation through Cloud Findings: Click the affected container image, open the Cloud Findings tab, and select a finding. Open the Remediation tab for instructions on remediating the container image. Instructions vary by finding; in this example the operating system needs to be updated. Explorer queries: Go to Explore in the left navigation, then Explorer. A custom query finds two CVEs related to PHP2Shell. Clicking a resource shows an overview, cloud findings, threat detections, vulnerabilities, and more. Save the query with the button in the upper right to turn on tracking for later use, additional dashboards, and reporting. The saved query is named \"PHP2Shell - tracking.\" Complex queries: Queries can find different forms of Toxic Combinations or identify old VMs and images, which can prompt shutting down or isolating old systems. The example query asks which systems with PHP2Shell share the same toxic combination as \"X public workloads\" with critical vulnerabilities and high privileges. Custom policy: A custom policy simplifies administration of PHP2Shell vulnerabilities. It lets a team ignore or close individual instances, add automations, notes, time boundaries, and more. Navigate to Policies, then Cloud Policies, select Custom, and click Create Custom Policy. Select Query, choose the saved query \"PHP2Shell - tracking,\" and click Create in the bottom right. Custom dashboard: To show PHP2Shell data on login to Tenable One Cloud Exposure, go to Dashboards, then All Dashboards, then click Create Dashboard. Select the saved query \"PHP2Shell - tracking,\" drag and drop widgets onto the dashboard, and click Save for a quick snapshot on opening Tenable One Cloud Exposure. Recurring daily report: In Explorer, select the \"PHP2Shell - tracking\" query, click Add in the right corner, and select Report. Schedule a daily PHP2Shell report to be sent, in this example through Microsoft Teams to members of the General channel every morning. Automation for new findings: To trigger notifications when new PHP2Shell resources appear, create an automated workflow based on the saved query. Navigate to Operations in the main navigation, then Risk Automations, then Create Automation. Select the PHP2Shell tracker query from the drop-down and click Create in the bottom right. Exposure Management with Tenable Hexa AI Tenable One includes all of the capabilities mentioned above and more. One important capability that’s only available in Tenable One is Tenable Hexa AI, the agentic AI engine that can answer questions, automate tasks, execute workflows, and more. Tenable Hexa AI can speed up your response to critical vulnerabilities like PHP2Shell. Key Tenable One with Tenable Hexa AI tips include: Find all PHP2Shell vulnerable assets and PHP installations. Simply click on Tenable Hexa AI and type “find all open vulnerabilities for CVE-2026-109618 or CVE-2026-109619” or “find all instances of PHP and create a new tag based on version number,” and Tenable Hexa AI will complete the request in minutes. Create new remediation initiatives and track status. Prompting Tenable Hexa AI to “create an exposure initiative for PHP2Shell,” will automatically define the initiative, create SLAs and provide the description and vulnerability filters. You can see the latest status of your PHP2Shell initiative in Exposure Response to help communicate progress to stakeholders. Automatically generate remediation tickets to address PHP2Shell. Use Tenable Hexa AI to create remediation tickets with a simple prompt such as “create remediation tickets for all systems vulnerable to CVE-2026-109618 and CVE-2026-109619. Assign the severity level as Critical and the due date as Immediate.” Explore the solution walk-through to learn more about Tenable One with Tenable Hexa AI. How to Identify, Prioritize, and Remediate php2shell Using Tenable One Exposure Management and Tenable Hexa AI. The demo starts by identifying overall exposure to php2shell. In Hexa AI, a prompt asks Hexa to find all php2shell vulnerability findings. Hexa finds 2,007 instances and provides an overview of the top 15. From there, all findings can be explored in the Exposure Findings view, which lists the full set of findings sorted by asset exposure score (AES). AES provides a way to prioritize the most important remediation actions. Next, remediation progress is tracked by returning to Hexa and prompting it to create an exposure initiative. The resulting initiative page is opened with the view option. On this page, tickets can be assigned and remediation status can be tracked for all php2shell vulnerabilities. Instead of creating tickets manually, Hexa can create them. Ticketing instructions are provided to Hexa, which asks the user to confirm the ticketing software to use. Jira is selected. Submitting the request automatically creates tickets on the user's behalf. A link is provided to learn more about Hexa AI. Want to learn more? Read the PHP2Shell Frequently Asked Questions blog to get the latest information about PHP2Shell. Watch the On-Demand Webinar Using Tenable to close PHP2Shell vulnerabilities: A product deep-dive. Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats. Learn more about Tenable One, the Exposure Management platform for the modern attack surface.","Tenable has released guidance on how to discover and remediate the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Given PHP's widespread use, organizations must act quickly to identify affected systems and apply patches. Tenable's platform, including Tenable One Attack Surface Management, Vulnerability Management, and Security Center, can help identify vulnerable PHP deployments and accelerate the remediation process.","Tenable details how to find and remediate PHP2Shell vulnerabilities using its platform.","https:\u002F\u002Fwww.tenable.com\u002Fblog\u002Fdiscover-and-remediate-php2shell-exposure-with-tenable","https:\u002F\u002Fwww.tenable.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002F640x360\u002Fpublic\u002Fimages\u002Farticles\u002Fdiscover-and-remediate-php2shell-exposure-with-tenable_0.png?itok=uB9ztCKV","2026-10-26T19:48:07+00:00","2026-10-26T23:00:14.518507+00:00",8,[17,20,23],{"name":18,"type":19},"Tenable One","product",{"name":21,"type":22},"Tenable","vendor",{"name":24,"type":25},"PHP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":46,"value":50,"context":48},"CVE-2026-109619",[21,18],{"controls":53,"vendors":139},[54,82,111],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,66,74],{"vendor_slug":60,"vendor_name":21,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":83,"name":84,"problem":85,"products":86},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"slug":112,"name":113,"problem":114,"products":115},"patch-management","Automated patch management","Known holes get closed in days, not months.",[116,123,131],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":112,"product_name":120,"url":121,"description":122},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[140],{"slug":60,"name":21,"logo_path":61,"roles":141},[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"critical-php2shell-vulnerabilities-demand-urgent-patching-and-asset-visibility","Critical PHP2Shell Vulnerabilities Demand Urgent Patching and Asset Visibility","The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) highlight the persistent risk posed by widely-deployed web technologies when critical flaws go unpatched. PHP's ubiquity across web infrastructure means a single unpatched deployment can serve as an entry point for attackers to gain remote code execution or shell access. Organizations often struggle to maintain a complete inventory of where PHP is deployed, particularly across external-facing assets, making discovery the first critical step. Without rapid identification and remediation workflows, even well-known vulnerabilities can linger in production environments long enough to be exploited at scale.",[148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":156,"PCI DSS Requirement 6":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"OWASP A06:2021 Vulnerable and Outdated Components":159,"CIS Control 7: Continuous Vulnerability Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"NIS2 requires essential and important entities to implement vulnerability handling and disclosure policies, making rapid response to critical CVEs like these a regulatory obligation.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches, which directly covers the need to remediate critical PHP flaws in cardholder data environments.","SI-2 requires organizations to identify, report, and correct information system flaws on defined timelines — a formal flaw remediation process would have ensured these critical PHP CVEs were patched promptly.","PHP2Shell exposure is a textbook instance of running a vulnerable component; OWASP A06 specifically warns against using software with known CVEs and urges continuous monitoring for such risks.","Regular, automated vulnerability scanning against a known asset inventory would have identified PHP2Shell-affected systems immediately upon CVE publication, enabling timely remediation before exploitation.","This control mandates timely identification and remediation of technical vulnerabilities in used software, directly applicable to discovering and patching PHP2Shell across all deployments.","Shell-exposure vulnerabilities like PHP2Shell can bypass authentication entirely; ensuring proper access controls and attack surface reduction limits the blast radius if a vulnerable endpoint is reached."]