Enki Whitehat Releases Free Scanner for 'PHP2Shell' Vulnerability

What happened

On the 23rd, NKI White Hat released a free tool that checks if a system is exposed to PHP2Shell, a high-risk weakness in PHP. PHP is a programming language used to build many websites. The flaw can let an attacker run harmful code from far away without logging in. The company also published a report that explains how the flaw works, which PHP versions are affected, how to reduce the risk, and how to apply official security patches.

Key numbers and facts

• Risk score: 9.2 out of 10 under the CVSS 4.0 rating system
• Two related IDs: CVE-2026-109618 and CVE-2026-109619
• Fixed versions to update to: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35
• The scanner does not use real attack code. It checks the PHP version and settings to make a first guess about exposure
• No login is needed to use the scanner website. Users just enter the URL they want to check

Some background

A CVE number is a public ID given to a known security flaw, so people can talk about the same problem in the same way. CVSS is a scoring system that rates how serious a flaw is, from 0 to 10. A higher score means more danger. This flaw is tied to how PHP handles memory, which is the part of a computer where a program stores data while it runs.

Why it matters

This flaw is serious because attackers may be able to take control of a server without a password. Many websites use PHP, so many organizations need to check their systems quickly. The company says it is important to find exposed systems and fix them before attackers do. It also plans to share more ways to track internet-facing IT assets and respond faster to new flaws.

What to watch

• Whether organizations update PHP to the fixed versions
• The additional guides NKI White Hat plans to publish on finding and managing exposed IT assets
• New methods the company releases for responding quickly to new security flaws