The security concern
Knowing you use PHP is not the same as knowing your exposure.
PHP2Shell refers to two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. The PHP project released security fixes on 21 October 2026. However, evaluating a particular environment requires more than matching a publicly detected technology or checking a single version number. [EXT-01, EXT-02, EXT-03]
Request a PHP2Shell Exposure Check
Deployed runtime
Which PHP version actually handles application requests?
Patch status
Is the runtime covered by an upstream fix or applicable vendor-maintained update?
Deployment context
Do multiple runtime versions, hosting components or container images require separate verification?
Configuration
Are settings relevant to the advisories understood and appropriately configured?
A version or technology signal alone may be insufficient to establish the status of a specific deployment.
Why work with cCurity
Security findings should lead to informed engineering decisions.
cCurity focuses on offensive security across applications, APIs and infrastructure, with an emphasis on exploitability, attacker reachability and actionable remediation.
The PHP2Shell Exposure Check provides a focused starting point for understanding whether further validation is appropriate. Where a broader security assessment is justified, cCurity’s offensive security services can examine authorised attack surfaces in greater depth.
Focus on the deployed environment and the evidence needed to assess a security concern.
Distinguish potential exposure indicators from conclusions that require further testing.
Help technical stakeholders understand what should be investigated, verified or addressed next.
Clarity before you go further.
Understand what the PHP2Shell Exposure Check covers, what it can establish, and what happens next.
Does using PHP mean our application is vulnerable?
−
+
No. Identifying PHP or a PHP-based framework does not establish whether a deployment is vulnerable. The actual runtime, applicable patches, deployment context and relevant configuration need to be considered.
Is the PHP2Shell Exposure Check a penetration test?
−
+
No. It is a focused, non-intrusive initial review. A penetration test involves a separately agreed scope and additional security testing.
Can you confirm our PHP security status from a public URL alone?
−
+
Not necessarily. Publicly observable information may be incomplete or may not identify the runtime actually processing requests. More reliable verification may require information supplied by your engineering or infrastructure team.
What technical information may be needed?
−
+
Depending on the agreed scope, useful information may include the deployed PHP runtime version, hosting or vendor details, package or patch records, and relevant configuration settings. The information required will be discussed before the review.
Will cCurity test our systems without permission?
−
+
No. The proposed process requires scope and authorisation to be established before technical review or testing activities begin.
Will the check prove that our environment is secure?
−
+
No. The review is limited to agreed PHP2Shell-related considerations. It cannot provide assurance about every application, infrastructure or security weakness.o. A PHP technology signal or version number alone does not establish exposure. The deployed runtime, patch status and relevant configuration need to be considered together.
What happens if further investigation is needed?
−
+
The observations can inform a discussion about the appropriate next step. If more extensive security testing is justified, its objectives, scope and authorisation would be agreed separately.
Should we wait for the exposure check before applying patches?
−
+
No. Organisations should follow applicable PHP and vendor security guidance. The exposure check is not a reason to delay security updates or established incident-response procedures.
Tell us what you're building, securing or preparing to launch. We'll help determine where an offensive-security assessment can create the most value.
Cookie preferences
Choose your cookie preferences. Your choices are saved on this device. Tracking integrations are not yet connected to these controls.