Organizations can get 15 days of free access to Qualys solutions to detect and address PHP2Shell vulnerabilities
Qualys is offering free access to its solutions to help organizations detect, validate and address exposure to PHP2Shell, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The service is available for 15 days from activation and covers up to 1,000 assets.
Both vulnerabilities have a CVSS v4.0 severity score of 9.2, and attack traffic has already been reported. They allow unauthenticated remote code execution, while exposed PHP worker memory can reveal passwords, tokens and API keys.
Although PHP has released fixes, Qualys Threat Research Unit found that nearly all installations are vulnerable or running unsupported versions. More than 70% use end-of-life or end-of-support versions that will not receive patches.
PHP2Shell Vulnerabilities and Fixes
According to anonymized data from more than 10,000 customers, Qualys Threat Research Unit (TRU) identified 167 million PHP package installations, 73% of which were on internet-facing assets.
Of the 156 million installations with a known version:
- 44 million (28%) were running vulnerable versions within supported PHP branches (8.2 to 8.5), for which fixes are available.
- 110 million (71%) were running end-of-life or end-of-support versions (PHP 5.4 to 8.1), most of which will not receive vendor patches.
- 581,000 (0.37%) had been patched within the first 24 hours after disclosure.
Qualys recommends mitigating exposure on unsupported versions where patches are unavailable, as upgrading or patching PHP may affect business operations.
The 15-day free service includes products from the Qualys TruRisk Platform, including Qualys VMDR, Enterprise TruRisk Management (ETM) and TruRisk Eliminate.
According to Qualys, these tools can help security teams:
- Discover: Identify vulnerable PHP installations, including those running in containers or bundled with other applications.
- Prioritise and validate: Focus on internet-facing systems and legacy versions, and assess whether existing security controls prevent exploitation.
- Patch supported versions: Apply available PHP fixes and restart services to activate them.
- Mitigate unsupported versions: Apply operating-system vendor backports where available, isolate affected systems, and plan upgrades or retirement where necessary.
- Verify remediation: Rescan systems to confirm that vulnerabilities have been addressed.
“PHP2Shell puts a large share of the web at risk, and over 70% of installations will not have a patch,” said Shailesh Athalye, Chief Product Solutions Officer of Qualys. “With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately. Qualys is making our services available so organizations can find, prioritize and close these exposures before they are exploited.”
Disclaimer: This article is based on Qualys’ official announcement and has been edited for length and readability. Vulnerability details, statistics and product capabilities are based on information provided by Qualys.
