Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

What happened

On the 26th, Logpresso, a Korean security company, announced its 'PHP2Shell Scanner' app. PHP2Shell refers to two remote code execution flaws found in PHP, a language used to build websites. Under certain conditions, an attacker without login rights could run harmful code on a server. The risk score is 9.2, which is the highest level. The scanner runs inside Logpresso's security monitoring platform. Users install the app and register the web addresses they want to check.

Key facts

• Two flaws: CVE-2026-109618 and CVE-2026-109619.
• Risk score: 9.2 out of 10, the highest level.
• Many web addresses can be registered at once.
• No separate testing setup is needed.

Why internal checks matter

Many outside scanning services can only see websites that are open to the internet. Systems inside a company network, such as internal tools and firewall management pages, are hard to check from outside. This scanner is designed to look at those internal PHP systems too.

Why it matters

PHP runs on many websites, so a flaw like this can affect many systems. The scanner helps companies find which systems are at risk, what PHP version they use, and whether their fixes worked. However, a scan only shows whether a flaw exists. It does not prove that someone has already broken in. To check for attacks, teams must also review server logs and system records.

What to watch

• Whether companies patch their PHP systems quickly.
• Whether the re-check feature confirms that fixes were applied.
• Whether further details about the attack conditions are released.