Tenable outlines detection and patching for PHP2Shell
Original title: Discover and remediate PHP2Shell exposure with Tenable
CVE-2026-109618 and CVE-2026-109619 affect PHP, which Tenable says runs on more than 70% of websites.
Tenable published guidance for finding and patching the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. It describes Attack Surface Management for internet-facing PHP, Vulnerability Management and Security Center detections including Linux package checks, Web App Scanning, and Cloud Exposure. Patch Management is said to match exposures to patches and confirm fixes with follow-up scans. The post does not name fixed PHP versions or report confirmed attacks.
Unconfirmed: The post does not state fixed version numbers or confirm real-world exploitation.
- Tenable says many sites still run unsupported PHP branches.
- ASM subscriptions cover PHP in applications and PHP end-of-life installs.
- Additional detections will follow as vendors publish fixes.
- Standard Web App Scanning policies discover PHP2Shell if all plugin groups are selected.
- Hexa AI prompts can create exposure initiatives and remediation tickets.
| Product | Affected |
|---|---|
| PHP | — |
- 1.Inventory externally facing and packaged PHP and scan for PHP2Shell.
- 2.Update affected PHP to the fixed versions vendors publish.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
7 min read at tenable.com
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) put security teams in a race against attackers.
By Team Tenable · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.