PHP2Shell

About this guide

Last updated: October 21, 2026

This page explains how to use Rapid7 products to find systems affected by these vulnerabilities and answers common questions. For a full description of the vulnerabilities, affected and fixed PHP versions, exploitation status, and temporary mitigations, read the Rapid7 Emergent Threat Response (ETR) blog post, CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP .

1. Product coverage at a glance

Rapid7 product coverage for PHP2Shell:

Exploitation status

The Cybersecurity and Infrastructure Security Agency (CISA) published an alert on critical PHP vulnerabilities  on October 21, 2026, urging immediate patching. The alert states that exploitation hadn’t been observed at the time of publication.

2. Important information

Apply interim protections

If you can’t patch promptly, CISA advises these actions:

• Consider taking a system offline if you can’t update it promptly or if it runs PHP 8.1 or an earlier unsupported version.
• Consider using a web application firewall (WAF) as a stopgap. A WAF may give some protection, but it doesn’t replace patching or the mitigations in the ETR blog post.

Avoid fake exploit code

Fake proof-of-concept exploit code that targets defenders often appears during high-profile vulnerability events. Run exploit code only from sources you trust, and only in an isolated environment.

3. Find and confirm exposure

3.1 Exposure Command, Vulnerability Management (InsightVM), and Nexpose

Rapid7 provides these vulnerability checks:

Content release

The Security Console shows this release as content update 1.1.4087 with ID 2432554137.

The content update released earlier on October 21, 2026, with ID 2061473995, doesn’t include these checks.

How the checks work

These remote, unauthenticated checks run from Scan Engines against HTTP and HTTPS services. They identify the PHP version that the web service reports.

The checks flag these PHP versions:

• PHP versions 7.4.0 through 8.1.x. This range covers the end-of-life 7.4, 8.0, and 8.1 branches.
• PHP 8.2.x before 8.2.35
• PHP 8.3.x before 8.3.36
• PHP 8.4.x before 8.4.27
• PHP 8.5.x before 8.5.12

Authenticated, package-based coverage for Linux distribution packages with backported fixes will be added as supported distributions publish their fixes. This page will be updated when the coverage is available.

Step 1: Get the new content

Security Consoles with automatic content updates enabled apply the release at their next scheduled update check. Rapid7 has already updated VM SaaS Security Consoles.

To update manually:

As a Global Administrator, from Command Home, go to Administration > Vulnerability Management > Console Administration > Console, Updates > Manual Update.

To verify that the PHP checks exist:

1. As a Global Administrator, from Command Home, go to Administration > Vulnerability Management > Console Administration > Troubleshoot, Run commands.
2. Verify that the first check exists by running the command show vuln php-cve-2026-109618.
3. Verify that the second check exists by running the command show vuln php-cve-2026-109619.

For more information, read Managing versions, updates, and licenses  and Using the command console .

Step 2: Rescan assets

Existing results update only after you rescan assets with the new content.

Check the scan template

Make sure the scan template discovers HTTP and HTTPS services on every port that your PHP applications use, including non-standard ports.

Optional: Scan for these vulnerabilities only

Scan only for these vulnerabilities to shorten scan time.

To create a scan template for these vulnerabilities:

1. Copy an existing scan template.
2. In the Vulnerability Checks settings of the template, disable the check categories you don’t need.
3. Add the individual checks php-cve-2026-109618 and php-cve-2026-109619. You can search by check ID, check name, or CVE ID.
4. Keep service discovery enabled for the web ports that your PHP applications use.
5. Save the template, and then scan your web servers.

For more information, read Configuring custom scan templates  and Selecting a scan template .

Step 3: Find affected assets

Filter vulnerabilities

1. Go to Findings > All Findings > Vulnerability Management > Scan and Agent Based Vulnerabilities > Apply Filters.
2. Filter by criteria such as CVE ID or Vulnerability Title. For the values to use, refer to the vulnerability checks.

Filter assets

1. Go to Assets & Identities > Vulnerability Management > Assets, and then select Go to Asset Search.
2. Filter by criteria such as CVE ID, Vulnerability Title, or Software name. For the values to use, refer to the vulnerability checks.
3. After the search completes, select Create Asset Group to save a filter of these assets that you can reference across reports, remediation projects, and dashboards.

Report on affected assets

To start a report in the Security Console:

1. Go to Reports & Dashboards > Vulnerability Management > Console Reports > Reports, and then select Create a report or New.
2. Under Scope, select the site, asset group, tag, or assets that you want to report on.
3. To limit the report to a vulnerability category or severity, go to Scope > Filter report scope based on vulnerabilities, and then filter by severity or category, such as PHP.
4. Choose a report type from the options in this section, and then generate the report.

Generated reports appear in View reports.

Option A: Built-in report templates

Use built-in report templates for ready-made, formatted reports to share with stakeholders.

Built-in report templates include:

• Audit Report - Detailed per-asset findings, including affected software and proof
• Top Remediations - Prioritized fixes that help you patch PHP across many hosts
• Executive Overview - High-level risk summary for management

Option B: CSV export

Use a CSV export for flat data that you can sort or share.

To export results as a CSV file:

Select Export, and then select a template, such as Basic Vulnerability Check Results.

Option C: SQL query export

Use an SQL query export for custom, precise results from the Reporting Data Model.

To export results with an SQL query:

1. Select Export > SQL Query Export.
2. Paste a query.

Use a query such as this example:

SELECT
  da.ip_address,
  da.host_name,
  dv.title,
  dvr.reference AS cve_id,
  dv.severity,
  dv.cvss_score,
  favi.port
FROM fact_asset_vulnerability_instance favi
JOIN dim_asset da USING (asset_id)
JOIN dim_vulnerability dv USING (vulnerability_id)
JOIN dim_vulnerability_reference dvr USING (vulnerability_id)
WHERE dvr.source = 'CVE'
  AND dvr.reference IN ('cve-2026-109618', 'cve-2026-109619')
ORDER BY dv.cvss_score DESC, da.ip_address;

Rapid7 also provides a collection of SQL queries for Vulnerability Management (InsightVM) .

Dashboard and Query Builder reporting

To apply a query to a dashboard card, open Dashboards, select Expand Card, and then use Add Criteria.

To open Query Builder:

1. Go to Reports & Dashboards > Vulnerability Management > Vulnerability Dashboard.
2. Select the magnifying glass or menu icon.

To add an asset group to the query in Standard mode:

1. Select Add.
2. Select a category, and then select the asset.groups field. You can also type a keyword in the search bar to find the field.
3. Select an operator and the asset group name, such as PHP Web Servers.
4. Select Apply and Save.

To add a CVE ID to the query:

1. Select Add again.
2. Select the vulnerability.cveIds field, an operator, and a CVE ID, such as CVE-2026-109618.
3. Select Apply and Save.

To add software to the query:

1. Select Add again.
2. Select the asset.software.vendor field, an operator, and PHP as the software name.
3. Select Apply and Save.

Use Expert Mode for more granular queries. For more information, read Query Builder .

To apply the saved query to a dashboard:

1. Go to Reports & Dashboards > Vulnerability Management > Vulnerability Dashboard.
2. Select Load Dashboard Query.

Known limitations of the current checks

The current checks have these limitations:

• Version disclosure - Detection relies on the web service reporting its PHP version, for example in the X-Powered-By response header. If version disclosure is turned off with expose_php = Off, or a proxy, load balancer, or WAF removes the header, the checks may not identify the PHP version.
• Backported fixes - Linux distributions that backport a fix usually keep the original upstream version number, so the checks may report a patched distribution build as vulnerable until package-based checks are available. Confirm against your vendor’s advisory and, if the package is fixed, apply a vulnerability exception.
• Rapid7 Agent (Insight Agent) - Scan Engines run these checks against network services. Rapid7 Agent (Insight Agent) assessments don’t evaluate these checks.

3.2 Attack Surface Management (Surface Command)

Attack Surface Management can ingest data from other sources, including Rapid7 products.

Confirm data source configuration

Confirm that your vulnerability data source, such as your Vulnerability Management (InsightVM) or Rapid7 connector, is connected and syncing.

1. Go to Data Connectors > Attack Surface Management > Connectors.
2. Search for Rapid7, and then verify that the Rapid7 connectors exist.
3. Go to Data Connectors > Attack Surface Management > Import Feeds.
4. Search for Rapid7, and then verify that the connectors are configured to import and have completed a recent import. To run a connector manually, select Run now.

Build a query

A query combines an asset type with a search pattern of property filters and relationships to other asset types.

To search for assets that a specific vulnerability affects:

1. Go to Assets & Identities > Attack Surface Management > Workspace.
2. Select + Query, and then select the Asset asset type.
3. Select the More options icon on Assets, and then select Add relationship > Exposure. For other products, select Finding or Vulnerability.
4. Select the More options icon on Exposure, and then select Filter result > CVEs and an operator. Use contains for CVE ID, title, and similar values.
5. To remove duplicates, turn on Distinct.
6. Select the Play icon to run the query.
7. Select Save to save the query. The saved query is then available under Queries.

Build widgets and dashboards

Dashboards contain widgets, and widgets are built from saved queries.

To build widgets:

1. Go to Assets & Identities > Attack Surface Management > Queries.
2. Select the saved query, and then select Widgets.
3. Select + Widget.

To build dashboards:

1. Go to Reports & Dashboards > Attack Surface Management > Attack Surface Dashboard.
2. Select + Dashboards to create a dashboard.
3. Select + Widgets to add your widgets.
4. To edit an existing dashboard, select the Edit icon.

Widgets are shared across your Surface Command instance, so any user can use or copy them. Editing a widget can affect other dashboards that use it. Connector updates overwrite edits to default dashboards, so build custom dashboards instead.

3.3 Velociraptor

The artifact Generic.Applications.PHPInventory inventories PHP on Windows, Linux, and macOS. It collects package versions, common binary and module paths, and running PHP processes.

Run the artifact in one of these ways:

• Single endpoint - Select the client, create a new collection, search for Generic.Applications.PHPInventory, and then start the collection.
• Fleet - Create a new hunt with the artifact.

Compare the PHP versions that you find with the fixed versions in the ETR blog post , and prioritize internet-facing servers.

PHP2Shell FAQs

Jump to a group of questions:

• Detection and scanning
• Versions and inventory
• Rapid7 products and updates

Detection and scanning

Does Rapid7 have vulnerability checks for these CVEs?

Yes. The checks are php-cve-2026-109618 and php-cve-2026-109619, in content release nexpose-content-1.1.4087, released October 21, 2026.

I searched my Security Console and can’t find the CVEs. Why?

Your console probably hasn’t received the new content yet. The earlier content update from October 21, 2026, with ID 2061473995, doesn’t include these checks. Update to nexpose-content-1.1.4087, ID 2432554137, or later, and then rescan. For the steps, read Step 1: Get the new content.

I updated the content. Why don’t I see any findings?

Findings appear only after you rescan. Check that the scan covers the HTTP and HTTPS ports that your PHP applications use. If your web servers don’t report their PHP version, read Known limitations of the current checks.

Do I need credentials or special scan settings?

No. The current checks are remote and unauthenticated. Authenticated, package-based checks will follow as Linux distributions publish fixes.

Will the Rapid7 Agent (Insight Agent) detect these vulnerabilities?

Not with the current checks, which Scan Engines run against web services. Scan your web servers with a Scan Engine.

How do I scan for only these vulnerabilities?

Follow the steps in Optional: Scan for these vulnerabilities only.

Versions and inventory

How do I find every system running PHP, including systems that aren’t vulnerable?

Run the Velociraptor artifact Generic.Applications.PHPInventory. The Vulnerability Management (InsightVM) software inventory can also help, but it may miss PHP that was built from source or bundled inside an application.

My Linux distribution backported the fix, but the asset is still reported as vulnerable. Why?

The current checks read the upstream PHP version that the web service reports, and distributions usually keep that version number when they backport a fix. Confirm the package against your vendor’s advisory and, if it’s fixed, apply a vulnerability exception. Package-based checks will recognize distribution fixes after Rapid7 releases them.

My systems run PHP 8.1, 8.0, 7.4, or an earlier version. Will the checks find them?

The checks flag PHP 7.4 through 8.1. They don’t assess versions earlier than 7.4 because no fix exists for those versions, so treat them as vulnerable. For remediation options, read the ETR blog post .

Where are the workarounds?

Temporary mitigations are in the ETR blog post . They reduce exposure on specific exploitation paths but don’t replace upgrading.

Rapid7 products and updates

How do I stay up to date?

This page and the ETR blog post  are updated as new information becomes available.

References

For more information, read these resources:

• CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP 
• Managing versions, updates, and licenses 
• Using the command console 
• Critical vulnerabilities in PHP require immediate patching , CISA alert, October 21, 2026

Change log