Qualys has announced a 15-day free service offering to help organisations detect, validate and mitigate exposure to PHP2Shell, two critical vulnerabilities in PHP tracked as CVE-2026-109618 and CVE-2026-109619. The offer covers up to 1,000 assets from activation.
Both vulnerabilities carry a CVSS v4.0 severity score of 9.2 and have reportedly been targeted in attack traffic. The flaws allow unauthenticated remote code execution, while leaked PHP worker memory could expose sensitive information, including passwords, authentication tokens and API keys.
Although PHP has released fixes for both vulnerabilities, research by the Qualys Threat Research Unit (TRU) indicates that a significant proportion of installations are running vulnerable or unsupported versions. More than 70% of installations assessed were using end-of-life (EOL) or end-of-support (EOS) versions that may not receive security patches.
Analysis of anonymised data from more than 10,000 Qualys customers worldwide identified 167 million PHP package installations, with 73% located on internet-facing assets. The findings highlight the potential scale of exposure across websites and business systems.
Among the 156 million installations with a known PHP version, approximately 44 million, or 28%, were running vulnerable versions within supported branches, PHP 8.2 to 8.5, for which fixes are available. Another 110 million installations, representing 71%, were running EOL or EOS versions ranging from PHP 5.4 to 8.1, most of which will not receive vendor patches. Qualys also found that only 581,000 installations, or 0.37%, had been patched during the first 24 hours after disclosure.
From vulnerability discovery to remediation
The free offering includes solutions from the Qualys TruRisk Platform, including Qualys Vulnerability Management, Detection and Response (VMDR), Enterprise TruRisk Management (ETM) and TruRisk Eliminate. The tools are designed to help security teams identify affected assets, assess risk and verify remediation through a connected workflow.
Qualys said its solutions can discover vulnerable PHP instances within 60 minutes, including deployments running in containers or bundled within other applications. Security teams can then prioritise internet-facing systems and legacy installations, while assessing whether existing security controls affect their exposure to exploitation.
For supported PHP versions, the recommended response is to apply the available fixes and restart PHP services to ensure the changes take effect. For PHP 8.1 and earlier, organisations can use operating system vendor backports where available, isolate affected systems and plan upgrades or retirement where patching is not possible.
The final step involves rescanning systems to verify that the identified exposures have been addressed.
“PHP2Shell puts a large share of the web at risk, and over 70% of installations will not have a patch,” said Shailesh Athalye, Chief Product Solutions Officer at Qualys. “With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately. Qualys is making our services available so organizations can find, prioritize and close these exposures before they are exploited.”
Organisations can activate the free service for up to 1,000 assets, with coverage lasting 15 days from activation.
