OFFENSIVE SECURITY FOR EMERGING TECHNOLOGY

PHP2Shell: Understand Your PHP Exposure.

An initial, authorised and non-intrusive review of relevant PHP runtime versions, patch status and configuration.

Request a PHP2Shell Exposure Check

A PHP technology signal does not establish that your environment is vulnerable. The review focuses on deployment-specific evidence.

The security concern

Knowing you use PHP is not the same as knowing your exposure.

PHP2Shell refers to two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. The PHP project released security fixes on 21 October 2026. However, evaluating a particular environment requires more than matching a publicly detected technology or checking a single version number. [EXT-01, EXT-02, EXT-03]

Request a PHP2Shell Exposure Check

Deployed runtime

Which PHP version actually handles application requests?

Patch status

Is the runtime covered by an upstream fix or applicable vendor-maintained update?

Deployment context

Do multiple runtime versions, hosting components or container images require separate verification?

Configuration

Are settings relevant to the advisories understood and appropriately configured?

A version or technology signal alone may be insufficient to establish the status of a specific deployment.

What the PHP2Shell Exposure Check covers

A focused review of the information that matters.

The proposed PHP2Shell Exposure Check considers three core areas within an agreed scope.

What the initial check may establish

Relevant runtime or patch information requiring verification. Potential exposure indicators based on advisory applicability. Configuration questions that need closer examination. Areas where additional technical evidence or testing would be appropriate.

What the initial check does not replace

The PHP2Shell Exposure Check is not a comprehensive penetration test, an incident-response investigation or a certification of security.

It does not, by itself, establish that an application is exploitable, that a system has been compromised, or that the entire environment is secure.

Active exploitation attempts, broader attack-path testing and comprehensive security assessments require separate scoping and explicit authorization.

PHP runtime identification

Review available information about the PHP runtime serving the relevant application or environment.

Configuration review

Consider configuration details relevant to the disclosed vulnerabilities and identify points that may require closer investigation.

Security patch verification

Compare available version, package and vendor information with relevant security advisories and documented fixes.

What the PHP2Shell Exposure Check covers

A focused review of the information that matters.

The proposed PHP2Shell Exposure Check considers three core areas within an agreed scope.

What the initial check may establish

What the initial check does not replace

The PHP2Shell Exposure Check is not a comprehensive penetration test, an incident-response investigation or a certification of security.

It does not, by itself, establish that an application is exploitable, that a system has been compromised, or that the entire environment is secure.

Active exploitation attempts, broader attack-path testing and comprehensive security assessments require separate scoping and explicit authorization.

PHP runtime identification

Review available information about the PHP runtime serving the relevant application or environment.

Configuration review

Consider configuration details relevant to the disclosed vulnerabilities and identify points that may require closer investigation.

Security patch verification

Compare available version, package and vendor information with relevant security advisories and documented fixes.

Why work with cCurity

Security findings should lead to informed engineering decisions.

cCurity focuses on offensive security across applications, APIs and infrastructure, with an emphasis on exploitability, attacker reachability and actionable remediation.

The PHP2Shell Exposure Check provides a focused starting point for understanding whether further validation is appropriate. Where a broader security assessment is justified, cCurity’s offensive security services can examine authorised attack surfaces in greater depth.

Technical

relevance

Focus on the deployed environment and the evidence needed to assess a security concern.

Practical

validation

Distinguish potential exposure indicators from conclusions that require further testing.

Actionable

next steps

Help technical stakeholders understand what should be investigated, verified or addressed next.

Cookie preferences

Choose your cookie preferences. Your choices are saved on this device. Tracking integrations are not yet connected to these controls.

Cookies Policy · Privacy Policy