Published 21 hours ago • loading... • Updated 21 hours ago
Astra Security Launches Free Tools to Help Organisations Identify PHP2Shell Vulnerabilities
The company’s checker and triage script help teams identify exposed systems and confirm patched runtimes after two CVSS 9.2 flaws were disclosed.
On Friday, Astra Security released two free resources to help organizations detect and respond to the critical PHP2Shell vulnerabilities disclosed this week.
Vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution through the PHP core runtime, posing critical risk to affected organizations.
While the PHP2Shell Checker identifies versions on public websites, php2shell-triage inspects binaries behind running PHP workers to catch servers reporting patched status but running vulnerable code.
Official fixes are available in PHP 8.5, 8.4, 8.3, and 8.2; organizations running end-of-life versions including 8.1 and earlier must plan upgrades or isolate vulnerable systems.
Astra founder and CEO Shikhil Sharma asked, "What is actually running right now?" emphasizing that organizations must assess systems beyond directly maintained applications, including vendor-managed infrastructure.