Discover and remediate PHP2Shell exposure with Tenable

Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster.

Key takeaways

1. The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they’re affected and update PHP to fixed versions.
2. Tenable helps you find PHP2Shell across your attack surface. Tenable One Attack Surface Management discovers externally facing PHP assets. Tenable One Vulnerability Management and Tenable Security Center provide detections, including local checks for Linux distribution packages. Tenable One Web App Scanning assesses web applications, and Tenable One Cloud Exposure covers cloud workloads.
3. Tenable accelerates remediation. Tenable Patch Management matches exposures to the right patches, launches patch workflows, and validates fixes with post-scan checks. Tenable One with Tenable Hexa AI lets you find vulnerable assets, create exposure initiatives, and generate remediation tickets with simple prompts.

Respond faster with Tenable solutions

The recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have put security teams in a race against attackers to remediate or mitigate exposure before their systems are targeted. PHP runs on more than 70% of websites, and many of those sites run unsupported, legacy branches that no longer receive upstream support. Organizations need to quickly find where they’re affected and update PHP to fixed versions.

To help cybersecurity teams accelerate emergency response, this blog outlines tips for using the Tenable solutions to identify vulnerable versions of PHP, prioritize remediation decisions, and implement patches as quickly as possible.

External Attack Surface Management

Tenable One Attack Surface Management (ASM) helps you discover externally facing assets running PHP. ASM continuously scans public data sources, such as DNS records, IP addresses, Autonomous System Numbers (ASN), WHOIS registrations, and neighboring IP ranges, to discover forgotten, rogue, or shadow IT assets that might be vulnerable to PHP2Shell. This is one of the first steps to take. It shows your digital footprint from the attacker’s perspective and identifies potential entry points into your organization.

Important ASM tips include:

• Use ASM to find additional top-level domains related to your organization. Suggested Domains helps you identify additional domains you may own based on ASN, brand, domain name, IP range, subdomain, or nameserver. You can also adjust the suggestion rules to prioritize domain names based on the likelihood of ownership.
• Search the inventory for PHP deployments. Create a query in ASM to identify PHP as a programming language filter. This gives you a quick starting point to assess locations, asset details, and software versions for further analysis.
• Continuously monitor for changes in your attack surface. Use Subscriptions in ASM to receive event-driven notifications and understand important changes in your attack surface that may create new exposure. Choose from hundreds of pre-built event categories or create a customized subscription. Two subscriptions apply to PHP: PHP in applications and PHP end-of-life installs.

Explore the solution walk-through to learn more about Tenable One Attack Surface Management.

Vulnerability Management

Tenable One Vulnerability Management and Tenable Security Center both help you find PHP2Shell vulnerabilities with detections for PHP, including local checks for PHP packages from Linux distributions. Tenable will release additional detections as vendors publish fixes in their security advisories.

Both solutions help you create out-of-band, tactical scans based on your preferred scan policy. Additional tips include:

• Update plugin feeds before running a scan. Tenable One Vulnerability Management automatically manages and updates plugin feeds through cloud synchronization by default. In offline or air-gapped environments, Tenable Security Center may require manual plugin feed updates.
• Use thorough testing to discover more vulnerabilities. Enabling thorough testing and paranoia mode in your scan policy conducts deeper assessments of your attack surface using multiple methods to discover risk. This is very important when you need to scan software across all system drives or investigate deep component-level software vulnerabilities where default settings may result in false negatives.
• Assign tags to indicate exposure. Use dynamic tagging to identify PHP2Shell on existing and newly discovered assets.
• Actively manage open remediations. Use Exposure Response in Tenable One Vulnerability Management to create Jira tickets or ServiceNow incidents and monitor remediation progress.

Check out these solution walk-throughs to learn more about Tenable One Vulnerability Management and Tenable Security Center:

Web App Scanning

Tenable One Web App Scanning (WAS) can help you assess your web applications for the presence of PHP2Shell, especially where PHP is embedded in content management systems (CMS), databases, and session management platforms. WAS crawls across modern web applications and APIs to identify OWASP Top 10 risks and web app component vulnerabilities. It inspects components, HTTP headers, server signatures, and cookies looking for PHP versions and associated vulnerabilities.

Tips for using WAS include:

• Standard WAS scan policies will discover PHP2Shell vulnerabilities. No need to create a customized policy as long as you select all plugin groups in your scan setup. WAS assessments take longer than traditional vulnerability management scans because WAS analyzes web frameworks and responses in more depth.
• Incorporate ASM results into new WAS assessments. WAS scans need known web app targets to point the scanner to assess risk. Use ASM findings to discover previously unknown web apps so that you can add them into your assessment scope.
• Filter on CVEs to find results. In the Findings page, you can apply filters to see where you are exposed. Generate reports and export results to easily send to application owners and remediation teams to fix.

See the solution walk-through to learn more about Tenable One Web App Scanning.

Patch Management

Tenable Patch Management can help you accelerate patching by matching asset and exposure findings to the patches you need to apply. You can launch patch workflows directly from Tenable One Vulnerability Management and Tenable Security Center to define the right patch strategy based on your organization’s requirements. Tenable Patch Management enables autonomous patching, safety controls and rollbacks, and automated post-scan validation to ensure exposures have been closed.

Important Tenable Patch Management tips include:

• Customize your patching strategy to address emergency vulnerabilities. Define patching schedules, deployment plans, and automation levels to address PHP2Shell and other critical out-of-band remediations.
• Verify patch implementation with remediation scans. Use remediation scans to confirm patches are installed and PHP2Shell vulnerabilities are marked as fixed. You can also see the latest patch information in the plugin output.
• Automatically correlate patches to vulnerable versions of PHP. Mapping patches to vulnerabilities by hand is time-consuming and error-prone. Tenable Patch Management finds the right patches for you automatically, pulling updates from official OS and third-party vendor repositories within 48 hours of release.

Browse the solution walk-through to learn more about Tenable Patch Management.

Cloud Security

Tenable One Cloud Exposure can help you find PHP2Shell vulnerabilities in cloud workloads using agent and agentless scanning, configuration auditing, and container inspection. Just as you would use of Tenable One Vulnerability Management, Tenable Security Center, and Tenable One Web App Scanning to address vulnerabilities in on-premises and self-managed hosts, Tenable One Cloud Exposure helps you manage and remediate vulnerabilities in Amazon Web Services, Microsoft Azure, and Google Cloud Platform environments.

Tips for using Tenable One Cloud Exposure include:

• Detect PHP2Shell in the Emerging Threats view. Click on the Risk tab to see the Emerging Threats page that shows all PHP2Shell vulnerabilities in one view. Toggle between virtual machines, virtual machine images, and container images to see impacted resources. This shows which resources are affected, so you can triage issues and accelerate remediation workflows.
• Create a policy to detect and respond to PHP2Shell vulnerabilities. Create a response playbook based on you business rules and preferences. Custom policies enable you to define rules, schedule reports, and create step-by-step remediation guides to fix issues immediately.
• Leverage integrated remediation workflows. For Infrastructure as Code (IaC) environments, use auto-generated IaC snippets supporting Terraform, CloudFormation, and JSON to push code-level corrections straight to your repositories. Otherwise, you can route service tickets into your existing IT and DevOps workflows to automate processes.

View the solution walk-through to learn more about Tenable One Cloud Exposure.

Exposure Management with Tenable Hexa AI

Tenable One includes all of the capabilities mentioned above and more. One important capability that’s only available in Tenable One is Tenable Hexa AI, the agentic AI engine that can answer questions, automate tasks, execute workflows, and more. Tenable Hexa AI can speed up your response to critical vulnerabilities like PHP2Shell.

Key Tenable One with Tenable Hexa AI tips include:

• Find all PHP2Shell vulnerable assets and PHP installations. Simply click on Tenable Hexa AI and type “find all open vulnerabilities for CVE-2026-109618 or CVE-2026-109619” or “find all instances of PHP and create a new tag based on version number,” and Tenable Hexa AI will complete the request in minutes.
• Create new remediation initiatives and track status. Prompting Tenable Hexa AI to “create an exposure initiative for PHP2Shell,” will automatically define the initiative, create SLAs and provide the description and vulnerability filters. You can see the latest status of your PHP2Shell initiative in Exposure Response to help communicate progress to stakeholders.
• Automatically generate remediation tickets to address PHP2Shell. Use Tenable Hexa AI to create remediation tickets with a simple prompt such as “create remediation tickets for all systems vulnerable to CVE-2026-109618 and CVE-2026-109619. Assign the severity level as Critical and the due date as Immediate.”

Explore the solution walk-through to learn more about Tenable One with Tenable Hexa AI.

Want to learn more?

Read the PHP2Shell Frequently Asked Questions blog to get the latest information about PHP2Shell.

Watch the On-Demand Webinar Using Tenable to close PHP2Shell vulnerabilities: A product deep-dive.

Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.

Learn more about Tenable One, the Exposure Management platform for the modern attack surface.