PHP2Shell

About this guide

Last updated: October 28, 2026

For a full description of the vulnerabilities, affected and fixed PHP versions, exploitation status, and temporary mitigations, read the Rapid7 Emergent Threat Response (ETR) blog post, CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP .

This page explains how to use Rapid7 capabilities to find systems affected by these vulnerabilities and answers common questions. The procedural steps presented in this documentation use the unified navigation  and assume Command Platform Login  is enabled for Vulnerability Management users.

1. Product coverage at a glance

Rapid7 coverage for PHP2Shell:

Exploitation status

The Cybersecurity and Infrastructure Security Agency (CISA) published an alert on critical PHP vulnerabilities  on October 21, 2026, urging immediate patching. The alert states that exploitation hadn’t been observed at the time of publication.

2. Important information

Apply interim protections

If you can’t patch promptly, CISA advises these actions:

• Consider taking a system offline if you can’t update it promptly or if it runs PHP 8.1 or an earlier unsupported version.
• Consider using a web application firewall (WAF) as a stopgap. A WAF may give some protection, but it doesn’t replace patching or the mitigations in the ETR blog post.

Avoid fake exploit code

Fake proof-of-concept exploit code that targets defenders often appears during high-profile vulnerability events. Run exploit code only from sources you trust and only in an isolated environment.

3. Find and confirm exposure

3.1 Exposure Command, Vulnerability Management (InsightVM), and Nexpose

Rapid7 provides these vulnerability checks:

How the checks work

There are three kinds of checks: Remote checks, run by Scan Engines against HTTP and HTTPS services, and identifying the PHP version the web service reports. Authenticated and agent checks, run by authenticated Scan Engine scans and the Rapid7 Agent, find PHP installed on the host itself. Distribution checks recognise vendors’ backported patch packages.

The checks flag these PHP versions:

• PHP versions 5.4.0 through 8.1.x. This range covers the end-of-life < 7.4, 8.0, and 8.1 branches.
• PHP 8.2.x before 8.2.35
• PHP 8.3.x before 8.3.36
• PHP 8.4.x before 8.4.27
• PHP 8.5.x before 8.5.12

Distribution checks that recognise vendors’ backported patch packages are available for Ubuntu, Gentoo, Red Hat Enterprise Linux, Rocky Linux, SUSE Linux Enterprise Server and F5 BIG-IP. Any other distributions covered by Rapid7 recurring coverage that publish an advisory will receive distribution-specific coverage.

Step 1: Get the new content

Security Consoles with automatic content updates enabled apply the release at their next scheduled update check. Rapid7 has already updated VM SaaS Security Consoles.

To update manually:

As a Global Administrator, from Command Home, go to Administration > Vulnerability Management > Console Administration > Console, Updates > Manual Update.

Verify that the PHP checks are available

Use these steps to confirm your Security Console has the content needed to detect CVE-2026-109618 and CVE-2026-109619.

Task 1: Check your content version

1. Sign in to the Security Console with an account that has Global Administrator permissions.
2. From Command Home, go to Administration > Vulnerability Management > Console Administration > Information.
3. Review the latest vulnerability content version listed, and confirm it includes the content release for these CVEs.

Task 2: Confirm checks exist for both CVEs

1. In the Security Console, select the search icon in the top right corner.
2. Search for CVE-2026-10961*.
3. Confirm that results are returned for both CVE-2026-109618 and CVE-2026-109619, and the available vulnerabilities align with the table found at the top of section 3.1.

If any CVE is missing, update your Security Console content and check again. After you have confirmed that the content is current, run a scan so your assets are assessed against the new checks.

Step 2.1: Rescan with a Scan Engine

Existing results update only after you rescan assets with the new content.

Check the scan template

Make sure the scan template discovers HTTP and HTTPS services on every port that your PHP applications use, including non-standard ports.

Optional: Scan for these vulnerabilities only

Scan only for these vulnerabilities to shorten scan time.

To create a scan template for these vulnerabilities:

1. Copy an existing scan template.
2. In the Vulnerability Checks settings of the template, disable the check categories you don’t need.
3. Add the individual checks, such as cve-2026-109618 and cve-2026-109619. You can search by check ID, check name, or CVE ID.
4. Keep service discovery enabled for the web ports that your PHP applications use.
5. Save the template, and then scan your web servers.

For more information, read Configuring custom scan templates  and Selecting a scan template .

Step 2.2: Rescan with an Rapid7 Agent

The Rapid7 Agent (Insight Agent) is a lightweight software agent deployed on assets across your environment that can perform regular data collection used for vulnerability assessment with the results displayed in your Vulnerability Management Security Console.

By default, Rapid7 Agents (Insight Agents) perform collections every 6 hours. Agent Assessments can also be triggered manually, see Run an On-Demand Scan for Vulnerabilities for more information .

Agent assessments search all paths automatically with no need for additional configuration.

If you have not deployed Rapid7 Agents (Insight Agents) to your environment, see install guide .

To verify if Insight Agents are deployed:

• From Command Home, go to Data Connectors > Agents.
• From Command Home, go to Assets & Identities > Vulnerability Management > Asset Sites, then search for the site named Rapid7 Insight Agents.

For more information, see Using the Rapid7 Agent (Insight Agent) with Vulnerability Management .

Step 3: Find affected assets

Filter vulnerabilities

1. Go to Findings > All Findings > Vulnerability Management > Scan and Agent Based Vulnerabilities > Apply Filters.
2. Filter by criteria such as CVE ID or Vulnerability Title. For the values to use, refer to the vulnerability checks.

Filter assets

1. Go to Assets & Identities > Vulnerability Management > Assets, and then select Go to Asset Search.
2. Filter by criteria such as CVE ID, Vulnerability Title, or Software name. For the values to use, refer to the vulnerability checks.
3. After the search completes, select Create Asset Group to save a filter of these assets that you can reference across reports, remediation projects, and dashboards.

Report on affected assets in the Security Console

To create a report in the Security Console:

1. From Command Home, go to Reports & Dashboards > Vulnerability Management > Console Reports > Reports, and then select Create a report or New.
2. Under Scope, select the site, asset group, tag, or assets that you want to report on.
3. Optionally, to limit the report to a vulnerability category or severity, go to Scope > Filter report scope based on vulnerabilities, and then filter by severity or category, such as PHP.
4. Choose a report type from the options in this section, and then generate the report.

Generated reports appear in View reports.

Option A: Built-in report templates

Use built-in report templates for ready-made, formatted reports to share with stakeholders.

Built-in report templates include:

• Audit Report - Detailed per-asset findings, including affected software and proof
• Top Remediations - Prioritized fixes that help you patch PHP across many hosts
• Executive Overview - High-level risk summary for management

Option B: CSV export

Use a CSV export for flat data that you can sort or share.

To export results as a CSV file:

Select Export, and then select a template, such as Basic Vulnerability Check Results.

Option C: SQL query export

Use an SQL query export for custom, precise results from the Reporting Data Model.

To export results with an SQL query:

1. Select Export > SQL Query Export.
2. Paste a query.

These SQL query examples can be used for reporting on PHP findings.

PHP Detected as a Service

SELECT DISTINCT
    da.ip_address,
    da.host_name,
    das.port,
    dp.name AS protocol,
    ds.name AS service_name,
    dsf.name AS service_fingerprint,
    dsf.version AS service_version
FROM dim_asset_service das
JOIN dim_asset da USING (asset_id)
JOIN dim_service ds USING (service_id)
JOIN dim_protocol dp USING (protocol_id)
LEFT JOIN dim_service_fingerprint dsf USING (service_fingerprint_id)
WHERE ds.name ILIKE '%php%'
   OR dsf.name ILIKE '%php%'
   OR dsf.version ILIKE '%php%'
ORDER BY da.ip_address, das.port;

PHP Detected in a Scan Fingerprint

SELECT DISTINCT da.ip_address AS "IP Address",
       da.host_name AS "Hostname",
       das.port AS "Port",
       dasc.name AS "Attribute",
       dasc.value AS "Value"
FROM dim_asset da
JOIN dim_asset_service das ON das.asset_id = da.asset_id
JOIN dim_asset_service_configuration dasc ON dasc.service_id = das.service_id
WHERE dasc.value ~* 'php'
ORDER BY da.host_name, das.port;

PHP Detected as Software

SELECT DISTINCT
    da.ip_address,
    da.host_name,
    dsoft.vendor AS software_vendor,
    dsoft.name AS software_name,
    dsoft.version AS software_version
FROM dim_asset_software dasoft
JOIN dim_asset da USING (asset_id)
JOIN dim_software dsoft USING (software_id)
WHERE dsoft.name ILIKE '%php%'
ORDER BY da.ip_address, dsoft.name;
 

PHP Detected as a Vulnerability

SELECT
  da.ip_address,
  da.host_name,
  dv.title,
  dv.severity,
  dv.cvss_score,
  favi.port
FROM fact_asset_vulnerability_instance favi
JOIN dim_asset da USING (asset_id)
JOIN dim_vulnerability dv USING (vulnerability_id)
WHERE dv.title ILIKE '%CVE-2026-109618%'
   OR dv.title ILIKE '%CVE-2026-109619%'
ORDER BY da.ip_address;

Rapid7 also provides a collection of SQL queries for Vulnerability Management (InsightVM) .

Dashboard and Query Builder reporting

To apply a query to a dashboard card, open Dashboards, select Expand Card, and then use Add Criteria.

To open Query Builder:

1. Go to Reports & Dashboards > Vulnerability Management > Vulnerability Dashboard.
2. Select the magnifying glass or menu icon.

To add an asset group to the query in Standard mode:

1. Select Add.
2. Select a category, and then select the asset.groups field. You can also type a keyword in the search bar to find the field.
3. Select an operator and the asset group name, such as PHP Web Servers.
4. Select Apply and Save.

To add a CVE ID to the query:

1. Select Add again.
2. Select the vulnerability.cveIds field, an operator, and a CVE ID, such as CVE-2026-109618.
3. Select Apply and Save.

To add software to the query:

1. Select Add again.
2. Select the asset.software.vendor field, an operator, and PHP as the software name.
3. Select Apply and Save.

Use Expert Mode for more granular queries. For more information, read Query Builder .

To apply the saved query to a dashboard:

1. Go to Reports & Dashboards > Vulnerability Management > Vulnerability Dashboard.
2. Select Load Dashboard Query.

Known limitations of the current checks

The current checks have these limitations:

• Version disclosure - Detection relies on the web service reporting its PHP version, for example in the X-Powered-By response header. If version disclosure is turned off with expose_php = Off, or a proxy, load balancer, or WAF removes the header, the checks may not identify the PHP version. Authenticated scans and the Rapid7 Agent don’t rely on version disclosure.
• Backported fixes - Linux distributions that backport a fix usually keep the original upstream version number, so the checks may report a patched distribution build as vulnerable until package-based checks are available. Confirm against your vendor’s advisory and, if the package is fixed, apply a vulnerability exception.
• CVE-2026-115560 - This is a potential check. Potential checks must be enabled in your scan template, and the Rapid7 Agent doesn’t evaluate them.

3.2 Attack Surface Management (Surface Command)

Attack Surface Management can ingest data from other sources, including Rapid7 products.

Confirm data source configuration

Confirm that your vulnerability data source, such as your Vulnerability Management (InsightVM) or Rapid7 connector, is connected and syncing.

1. Go to Data Connectors > Attack Surface Management > Connectors.
2. Search for Rapid7, and then verify that the Rapid7 connectors exist.
3. Go to Data Connectors > Attack Surface Management > Import Feeds.
4. Search for Rapid7, and then verify that the connectors are configured to import and have completed a recent import. To run a connector manually, select Run now.

Build a query

A query combines an asset type with a search pattern of property filters and relationships to other asset types.

To search for assets that a specific vulnerability affects:

1. Go to Assets & Identities > Attack Surface Management > Workspace.
2. Select + Query, and then select the Asset asset type.
3. Select the More options icon on Assets, and then select Add relationship > Exposure. For other products, select Finding or Vulnerability.
4. Select the More options icon on Exposure, and then select Filter result > CVEs and an operator. Use contains for CVE ID, title, and similar values.
5. To remove duplicates, turn on Distinct.
6. Select the Play icon to run the query.
7. Select Save to save the query. The saved query is then available under Queries.

Build widgets and dashboards

Dashboards contain widgets, and widgets are built from saved queries.

To build widgets:

1. Go to Assets & Identities > Attack Surface Management > Queries.
2. Select the saved query, and then select Widgets.
3. Select + Widget.

To build dashboards:

1. Go to Reports & Dashboards > Attack Surface Management > Attack Surface Dashboard.
2. Select + Dashboards to create a dashboard.
3. Select + Widgets to add your widgets.
4. To edit an existing dashboard, select the Edit icon.

Widgets are shared across your Surface Command instance, so any user can use or copy them. Editing a widget can affect other dashboards that use it. Connector updates overwrite edits to default dashboards, so build custom dashboards instead.

3.3 Velociraptor

The artifact Generic.Applications.PHPInventory inventories PHP on Windows, Linux, and macOS. It collects package versions, common binary and module paths, and running PHP processes.

Run the artifact in one of these ways:

• Single endpoint - Select the client, create a new collection, search for Generic.Applications.PHPInventory, and then start the collection.
• Fleet - Create a new hunt with the artifact.

Compare the PHP versions that you find with the fixed versions in the ETR blog post , and prioritize internet-facing servers.

Run the Velociraptor hunt

To import the artifact:

1. In Velociraptor, navigate to the Artifacts section and select Add an Artifact.
2. In the new window that opens, copy the content from this page and paste it into the new artifact CLI window: https://docs.velociraptor.app/exchange/artifacts/pages/phpinventory/ .
3. Select Save.

To start a hunt:

1. In the left navigation menu, select Hunt Manager.
2. Select the + button (Start New Hunt) at the top of the interface.
3. Complete the initial configuration tab (such as hunt description, tags, or client filter conditions) and select Next.
4. Select the artifacts:
   1. Navigate to the Select Artifacts tab.
   2. Use the search bar to find the specific artifact you want to run (for example, typing a keyword such as PHPInventory. You are looking for the Generic.Applications.PHPInventory artifact.
   3. Select the artifact(s) you wish to include in the hunt.
5. Optionally, if the artifact requires parameters, such as file paths, IOC hashes, or search terms, enter them in the artifact’s parameter configuration fields.
6. Select Next to review your hunt settings and artifact selection
7. Select Launch to start the hunt across your fleet.

3.4 SIEM (InsightIDR)

SIEM (InsightIDR) includes built-in detection rules that identify post-exploitation activity associated with web shells, which attackers commonly use after exploiting vulnerabilities such as CVE-2026-109618 and CVE-2026-109619 in PHP.

These rules detect activity that follows a successful compromise. They do not detect or prevent the initial exploitation.

Built-in detection rules:

• WebShell - Linux Reconnaissance and Network Discovery
• WebShell - System Enumeration and Credential Harvesting

Rapid7 Managed Detection & Response customers

Rapid7 is actively monitoring for post-exploitation activity using the detection rules above, within your SIEM (InsightIDR) environment. No action is required to enable this monitoring.

Recommended steps:

Review our blog post for the fixed PHP versions and mitigation steps: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP 

Customers without Managed Detection & Response

You can monitor for and detect post-exploitation activity using the detection rules above.

Recommended steps:

1. Open your detection rule library and locate both rules.
2. Confirm each rule is configured to create alerts or investigations in your organisation’s tenant.
3. Review the blog post for the fixed PHP versions and mitigation steps: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP 
4. Patch affected PHP installations.

3.5 Cloud Security (InsightCloudSec)

Cloud Security (InsightCloudSec) uses the Host Vulnerability Assessment (HVA) and/or Container Vulnerability Assessment (CVA) features to assess resources for vulnerabilities. Ensure these features are enabled to view vulnerability findings.

The vulnerability databases used for Cloud Security are updated dynamically, meaning the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 are available within Cloud Security.

Automatic and manual assessment options

Assessment will automatically happen for newly discovered instances and containers.

After the initial assessment:

• HVA will run once a week
• CVA will run every two days

To manually trigger an assessment:

1. From Command Home, go to Security > Vulnerabilities > Resources.
2. For the resource in question, go to Action > Scan Resource.

Vulnerabilities page

From Command Home, go to Findings > Host and Container Vulnerabilities. The data is split across three tabs: Vulnerabilities, Software, and Resources.

Assess by CVE ID

1. Open the Vulnerabilities tab and search for the CVE ID.
2. Select the Action menu (…), then View Resource(s) Scan List. The Resources tab opens already filtered to that vulnerability.
3. Filter by resource type (host instance or container) to narrow the results.

Assess by software (PHP and its version)

This helps when scan content hasn’t caught up, or when there is no CVE yet.

1. Open the Software tab, select Add Filters, and add the property Software Name contains with the value PHP, then select Apply.
2. Select a software name to open its details. The Resources tab shows every resource associated with that software.

Narrow scope with filters

Filters can use properties such as cloud accounts, clusters, and resource groups, and you can stack several by selecting Add Filter. Tag searches are case insensitive and new tags are harvested every 12 hours.

To save filters, from the ellipsis menu, select Save Filter, then name it, optionally set it as your default, and optionally make it public so others can use it.

Exporting results

Select Download on a tab to get a CSV of the data currently displayed. Preparation times out after 10 minutes, so apply filters first.

On the Resources view, select Download Vulnerability Report for a detailed export containing both resource and vulnerability details. It’s limited to one million records and can be reduced in size by using filters.

Use the Action menu to trigger an on-demand scan or download a software bill of materials (SBOM).

Acting on the result set

From a software detail view, you can use Query Filters and Insights to act on the result set. Vulnerability findings can also drive alerts, ticketing, remediation workflows, and data exports.

Vulnerability Management (InsightVM) integration

With the Vulnerability Management (InsightVM) integration configured, go to Host and Container Vulnerabilities > Settings > Vulnerability Management Vulnerabilities and toggle it on to show Vulnerability Management (InsightVM) data alongside Cloud Security (InsightCloudSec) data.

3.6 Remediation Hub

Remediation Hub offers a couple of quick ways to view remediations for all affected assets across Vulnerability Management (InsightVM), Cloud Security (InsightCloudSec), and supported Attack Surface Management (Surface Command) connectors.

For details about using Remediation Hub, read Prioritize and act on remediations .

To view affected assets using the Emergent Threats banner:

1. From Command Home, go to Response & Remediation > Remediation Hub.
2. Expand the Emergent Threats banner at the top of the page.
3. Select View Remediation next to the CVE you want to examine.

The remediation details panel opens for the CVE where you can browse affected assets, remediation guidance, and CVE properties.

To view affected assets using filters:

1. From Command Home, go to Response & Remediation > Remediation Hub.
2. Select Filters.
3. Add a filter:
   1. Select Remediations for criteria.
   2. Select contains for operator.
   3. Enter php for value.
4. Select Apply.

3.7 Bulk Export MCP

Rapid7 provides a free, open-source MCP server and agent skill for bulk export.

Bulk export creates a local offline replica of your Rapid7 data that an AI assistant can query quickly, which reduces token cost and the time it takes to receive an answer.

You can ask natural-language questions about your PHP exposure, such as which assets are affected by CVE-2026-109618 and CVE-2026-109619, without needing to write queries.

Before you begin

Create a Rapid7 API key with the permissions that Bulk Export needs , and note your Platform region. Confirm your vulnerability content is current and recent scans have completed, so the export includes the PHP CVEs. For more information about API keys, read Manage Platform API Keys .

Install and configure

The installation, configuration, skill setup, and verification steps differ according to the AI client. The details are maintained by Rapid7 in the project README file at: Rapid7 Bulk Export MCP Server on GitHub .

Example prompt

Once the server and skill are connected, enter this prompt:

Load the latest vulnerability data from Rapid7, then help me assess our exposure to CVE-2026-109618 and CVE-2026-109619 (critical PHP vulnerabilities allowing unauthenticated remote code execution).
Use this Rapid7 blog post for the fixed versions and mitigation guidance: https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/ 

1. List every asset with a finding for either CVE. Include asset name,
   IP address, operating system, the CVE ID, severity, and the date
   first found.
2. List assets with PHP installed, according to the impacted and fixed versions in the Rapid7 Blog Post on PHP.
3. Group results by site or owner, and flag assets that are internet
   facing or business critical, where that data is available.
4. Rank the top 20 assets to patch first and explain why.
5. Summarise how many assets are affected, how many have already been
   remediated, and what has changed since last week.

Tell me which fields were missing from the data, and do not guess.
Present the results as a table I can export to CSV.

Follow-up prompts

• Which affected assets are tagged as production?
• Show assets where PHP remediation was recorded, and the date.
• Write a short summary of our PHP exposure for a non-technical audience.

Best practice for working with AI clients

• Validate the answers you receive - Spot-check the results in the Rapid7 Security Console, especially validate the counts and priorities.
• Control access - A bulk export can contain your whole vulnerability dataset, so limit who can run it and which AI tools can reach the data.
• Keep data private - The server and skill are open source, so you can inspect the code. Check where your chosen AI client sends prompts and data, as that depends on the client and model you use.
• Refresh the data - The local copy is a snapshot, so reload it after new scans or after patching.

3.8 Application Security

Rapid7 Application Security includes PHP Detection in its Technology Detection module and a PHP2Shell check in its Remote Code Execution module. Use these checks to configure a scan, review the findings, and reassess your application after patching.

Test for PHP2Shell

There are 2 complementary detection methods:

• Technology Detection, PHP Detection - Matches an identified PHP version against known vulnerability information. This is version-based evidence of potential exposure, not confirmation that code execution is possible. If the PHP version is not disclosed or cannot be identified, the check may not report a finding. It covers both CVEs.
• Remote Code Execution, PHP2Shell - Sends targeted requests and examines session-handling responses for behavior consistent with CVE-2026-109619. This active check uses response evidence rather than a PHP version comparison. It does not demonstrate arbitrary code execution or independently verify CVE-2026-109618.

Configure a PHP2Shell scan

For a single scan that includes both PHP2Shell checks, first create a custom attack template. Then select it in your application scan configuration, configure Chromium for Technology Detection, and run the scan.

Task 1: Create a custom attack template

1. From Command Home, go to Administration > Application Security Settings.
2. In Attack Options > Templates, select Create.
3. Name the template, for example PHP2Shell and TD.
4. On the Active Attack Modules tab, turn on Remote Code Execution. This module contains the PHP2Shell check for CVE-2026-109619.
   1. Optionally, to run only the response-based PHP2Shell check, select the default Arbitrary Code Execution attack template instead. That template includes Remote Code Execution but not Technology Detection, so it does not provide PHP version-based assessment.
5. On the Passive Attack Modules tab, turn on Technology Detection, which includes PHP Detection.
6. Select Save and Exit to save the custom template.

Task 2: Select the template and configure Chromium

1. From Command Home, go to Assets & Identities > Applications.

2. Open the application you want to test and create or edit its scan configuration.

3. Under Attack Templates, in the Custom Templates list, select the template you created in Task 1.

4. In the same scan configuration, go to Custom Options > Advanced Options > ScanConfig and set JavaScriptEngine to Chromium.

   Chromium is required for Technology Detection. The PHP2Shell response-based check under Remote Code Execution does not depend on this setting.

5. Confirm that the intended application URLs are in scope.

6. Save the scan configuration and select Save and Scan.

Technology Detection may report separate findings for CVE-2026-109618 and CVE-2026-109619 against the same application URL. These findings refer to 2 PHP runtime vulnerabilities, not necessarily 2 affected PHP installations. Review each finding’s CVE, severity, and remediation guidance.

Review the scan results

Technology Detection identifies potentially affected PHP versions, while Remote Code Execution performs targeted testing for the PHP2Shell vulnerability. Together, the 2 methods provide complementary evidence to help identify affected applications without requiring arbitrary code execution on the server.

A PHP2Shell finding appears under Remote Code Execution.

PHP version-based findings appear under Technology Detection.

PHP version-based findings

For findings produced through PHP Detection, review these details:

• The detected PHP version
• The CVE referenced by each finding
• The affected-version information

Recommended remediations

These findings match the detected PHP version to known vulnerability data. They do not establish exploitability or show that the scanner executed code on the server. A server with hidden version headers or a vendor-backported patch may require further investigation.

PHP2Shell RCE finding

The PHP2Shell check under Remote Code Execution reports a finding when the server returns session-handling behavior consistent with CVE-2026-109619. It is a targeted response-based indicator, not a full exploit or a check for both PHP2Shell CVEs.

Open the finding and review the recorded request and response evidence, together with its description and remediation guidance. Confirm that the response matches the check’s stated conditions. The finding describes observed response behavior. It does not establish the installed PHP version or demonstrate arbitrary code execution.

Re-scan after you patch

After you update PHP to a patched release, use the validation scan feature to verify that the reported vulnerabilities are resolved.

To run a validation scan:

1. Open the application containing the original PHP2Shell findings.
2. Select the completed scan that ran with the PHP2Shell and Technology Detection attack template before you applied the patch.
3. Open the Vulnerabilities tab.
4. Select the PHP2Shell findings you want to retest, or leave all findings unselected to validate all vulnerabilities from the scan.
5. From the Vulnerabilities tab of the original PHP2Shell scan, select Validate Vulns to start the validation scan.

When validation is complete, open the Validation History tab to review the results. Confirm that both the PHP version-based findings under Technology Detection and the PHP2Shell finding under Remote Code Execution are no longer detected, where validation supports those checks. For more information, read Test vulnerability remediation .

If necessary, run a new full scan using the same configuration to reassess the application and confirm that the intended URLs and detection modules are covered. Use the scan results alongside host or package-manager confirmation of the installed PHP update to verify remediation. The absence of findings alone does not guarantee that all affected PHP installations are patched.

PHP2Shell FAQs

Jump to a group of questions:

• Detection and scanning
• Versions and inventory
• Rapid7 products and updates

Detection and scanning

Does Rapid7 have vulnerability checks for these CVEs?

Yes. Read Product coverage at a glance.

I searched my Security Console and can’t find the CVEs. Why?

Your console likely hasn’t received the new content yet. See section 3.1, Step 1: Get the new content for guidance on updating and validating the content version.

I updated the content. Why don’t I see any findings?

Findings appear only after you rescan. Check that the scan covers the HTTP and HTTPS ports that your PHP applications use. If your web servers don’t report their PHP version, read Known limitations of the current checks.

Do I need credentials or special scan settings?

No. The current checks are remote and unauthenticated. Authenticated, package-based checks will follow as Linux distributions publish fixes. By default, the authenticated Windows checks scan PHP standard install locations. To find php.exe anywhere on the system using the Scan Engine, Windows File System Search must be enabled in the scan template. Agent assessments search all paths automatically with no need for additional configuration.

Will the Rapid7 Agent (Insight Agent) detect these vulnerabilities?

Yes. Content release 1.1.4092 (October 23, 2026) adds authenticated checks for CVE-2026-109618 and CVE-2026-109619 that run on the Rapid7 Agent and on authenticated Scan Engine scans. Make sure your Security Console has the latest content. Your next agent assessment or authenticated scan will then evaluate your assets. The Rapid7 Agent also covers Windows hosts. Authenticated Scan Engine checks for Windows are also available as of content release 1.1.4096.

How do I scan for only these vulnerabilities?

Follow the steps in Optional: Scan for these vulnerabilities only.

Versions and inventory

How do I find every system running PHP, including systems that aren’t vulnerable?

Run the Velociraptor artifact Generic.Applications.PHPInventory. The Vulnerability Management (InsightVM) software inventory can also help, but it may miss PHP that was built from source or bundled inside an application.

My Linux distribution backported the fix, but the asset is still reported as vulnerable. Why?

Distribution checks are now available for a variety of Linux distributions, described in the coverage table in Section 3.1. These checks recognise vendors’ backported patch packages. Use an authenticated scan or the Rapid7 Agent. Any other distributions covered by Rapid7 recurring coverage that publish an advisory will receive distribution-specific coverage. Until then, confirm the package against your vendor’s advisory and, if it’s fixed, apply a vulnerability exception.

Does Rapid7 detect CVE-2026-115560?

Yes, as a potential vulnerability, from content release 1.1.4094. Potential checks must be enabled in your scan template. The Rapid7 Agent doesn’t evaluate potential checks, so use a Scan Engine scan. The PHP Foundation describes this vulnerability as an unlikely remote code execution vector, and a fix isn’t available yet. Until it is, you can turn off PHP’s upload progress tracking: set session.upload_progress.enabled=0 in php.ini, then restart PHP or your web server.

Where are the workarounds?

Temporary mitigations are in the ETR blog post . They reduce exposure on specific exploitation paths but don’t replace upgrading.

Rapid7 products and updates

Are Rapid7 products affected?

For the status of each Rapid7 product, read Product coverage at a glance.

Does Rapid7 MDR provide detection or threat hunting for this?

For more information, read InsightIDR and Managed Detection and Response (MDR).

How do I stay up to date?

This page and the ETR blog post  are updated as new information becomes available.