Insignary releases free scanner for PHP2Shell and Node2Shell

Insignary’s free Linux scanner, insignary-chk, finds servers and images exposed to PHP2Shell and Node2Shell, both now on CISA’s KEV list.

Insignary released insignary-chk, a free, read-only, single-file scanner that looks for Linux servers and container images exposed to PHP2Shell and Node2Shell. PHP2Shell covers unauthenticated remote code execution flaws in PHP runtimes used by Apache mod_php, PHP-FPM and others. Node2Shell is an out-of-bounds write in the Node.js Brotli library; the tool also checks Brotli outside Node.js. Fixes were released on October 21, 2026, and CISA added both issues to its Known Exploited Vulnerabilities catalog. The scanner needs no installation, runs only on Linux x86_64, does not transmit data by default, ranks findings by urgency, flags end-of-life versions, and complements Insignary Clarity SCA.