[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBSJUiwFojBon2aqxAqUkxXnW3XkfJDzniTPom2ZFyAY":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"336a06e3-e4b6-4dd2-8895-e247e78e84cf","PHP2Shell on Windows and macOS: Automating the PHP Upgrade, With or Without an Agent","php2shell-on-windows-and-macos-automating-the-php-upgrade-with-or-without-an-age-0f1dc5","Executive Summary PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution on exposed PHP servers. PHP has released fixed versions. On Linux, distribution packages carry the fix. On Windows and macOS, they don’t: Microsoft and Apple don’t ship PHP, so the fix is an in-place PHP upgrade that has traditionally been done by hand, one […]","Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), enable unauthenticated remote code execution on exposed PHP servers. While Linux distributions offer straightforward fixes, Windows and macOS require manual PHP upgrades as Microsoft and Apple do not ship PHP. Qualys TruRisk Eliminate provides a Custom Assessment and Remediation (CAR) capability to automate this upgrade process for both agent-based and agentless environments.","PHP2Shell vulnerabilities allow unauthenticated RCE; Qualys offers automated remediation for Windows\u002FmacOS.","https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F11\u002F04\u002Fphp2shell-windows-macos-car-upgrade-scripts","https:\u002F\u002Fblog.qualys.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FBlog-Images-1080x1080.Cloud_.Agent_.2025.Updates-4-8.png","2026-11-04T09:20:32+00:00","2026-11-04T10:01:35.596509+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"Qualys","vendor",{"name":24,"type":19},"TruRisk Eliminate",{"name":26,"type":27},"Custom Assessment and Remediation (CAR)","technology",{"name":29,"type":19},"Homebrew",{"name":31,"type":22},"Microsoft","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-109618","PHP2Shell vulnerability allowing RCE",{"type":57,"value":61,"context":59},"CVE-2026-109619",[31,21,18],{"controls":64,"vendors":146},[65,94,121],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,113],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":108,"vendor_name":21,"vendor_logo":109,"product_slug":95,"product_name":110,"url":111,"description":112},"qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":122,"name":123,"problem":124,"products":125},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[126,133,138],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":128,"url":131,"description":132},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":134,"product_name":135,"url":136,"description":137},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",[147],{"slug":108,"name":21,"logo_path":109,"roles":148},[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":162},"php2shell-rce-vulnerabilities-demand-immediate-manual-patching-on-windows-and-macos","PHP2Shell RCE Vulnerabilities Demand Immediate Manual Patching on Windows and macOS","Two critical unauthenticated remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) expose servers to full compromise without requiring any attacker credentials. The risk is compounded on Windows and macOS environments because neither Microsoft nor Apple ship PHP updates through their native patch channels, leaving organizations reliant on manual upgrade processes that are easily overlooked. This gap highlights how platform-specific software dependencies can create blind spots in standard patch management workflows. Organizations that do not maintain an accurate inventory of non-OS software—especially internet-facing runtimes like PHP—are particularly vulnerable to exploitation before patches are applied.",[155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":163,"PCI DSS Requirement 6":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"CIS Control 17: Incident Response Management":166,"OWASP A06:2021 Vulnerable and Outdated Components":167,"CIS Control 7: Continuous Vulnerability Management":168,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":169},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities; failing to patch critical RCE vulnerabilities in internet-facing services represents a direct breach of this obligation.","Requirement 6 mandates that organizations develop and maintain secure systems by protecting them against known vulnerabilities, which includes promptly applying security patches to PHP servers that may process or be adjacent to cardholder data environments.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined timeline; a formal flaw remediation process would have ensured PHP was patched promptly even when outside OS update channels.","With active exploitation possible through unauthenticated RCE, a tested incident response plan is essential to contain, eradicate, and recover from compromises on exposed PHP servers while patching is underway.","PHP is exactly the type of third-party runtime component OWASP A06 warns against leaving unpatched, particularly when it is internet-facing and susceptible to unauthenticated remote code execution.","Regular authenticated scanning would have detected the outdated, vulnerable PHP versions on Windows and macOS systems before attackers could exploit the unauthenticated RCE flaw.","This control requires timely identification and remediation of technical vulnerabilities in software; it directly addresses the failure to patch PHP on platforms lacking automated update delivery."]