[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9ZkMhPQipzAOM4Q0ggX4OwdqQNrJNPX22krvo86FegI":3},{"article":4,"iocs":38,"watch_terms":45,"solutions":46,"lesson":22},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"30a5e5c4-d449-4658-af41-21ef9a97608f","PHP2Shell Exposure Depends on More Than Whether You Use PHP","php2shell-exposure-depends-on-more-than-whether-you-use-php-87da06","PHP2Shell exposure can extend into bundled runtimes, containers, and hosted applications. Learn why identifying affected PHP is only the first step toward validating exploitability.","The PHP2Shell vulnerabilities (CVE-2026-109618\u002FCVE-2026-109619) can affect systems that don't directly use PHP, including bundled runtimes, containers, and hosted applications. Identifying affected PHP is only the first step; understanding exploitability requires analyzing the specific environment, runtime, and vendor guidance, especially in managed services where responsibility for patching may lie with the provider.","PHP2Shell vulnerabilities extend beyond direct PHP usage into bundled runtimes and containers.","https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fattack-blogs\u002Fphp2shell-exposure-exploitability\u002F","https:\u002F\u002Fhorizon3.ai\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FAI-Accelerated-Exploitation-red.png","2026-10-22T19:00:56+00:00","2026-10-23T15:08:58.601682+00:00",8,[17],{"name":18,"type":19},"PHP2Shell","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":20,"icon":22,"name":23,"slug":24},null,"Vulnerabilities","vulnerabilities",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39,43],{"type":40,"value":41,"context":42},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":40,"value":44,"context":42},"CVE-2026-109619",[],{"controls":47,"vendors":131},[48,77,102],{"slug":49,"name":50,"problem":51,"products":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":78,"name":79,"problem":80,"products":81},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[82,89,97],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":84,"url":87,"description":88},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":98,"product_name":99,"url":100,"description":101},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":103,"name":104,"problem":105,"products":106},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",[132],{"slug":133,"name":134,"logo_path":135,"roles":136},"horizon3-ai","Horizon3.ai","\u002Fvendor-logos\u002Fhorizon3-ai.png",[137],"reported_by"]