Qualys has announced that it is offering its solutions free as a service to the community to help organisations detect, validate and mitigate their exposure to PHP2Shell, two critical vulnerabilities in PHP tracked as CVE-2026-109618 and CVE-2026-109619.
The free service is available for 15 days for up to 1,000 assets from the time of activation. Both vulnerabilities are rated CVSS v4.0 9.2, and attack traffic has already been reported. The flaws allow unauthenticated remote code execution, while leaked PHP worker memory can expose passwords, tokens and API keys.
While PHP has released fixes for both vulnerabilities, the Qualys Threat Research Unit (TRU) found that nearly all PHP installations are either vulnerable or running unsupported versions. More than seven in 10 installations are running end-of-life or end-of-support versions, for which a patch will not be available.
Based on anonymised data from more than 10,000 customers globally, the Qualys TRU team identified 167 million PHP package installations, with 73 per cent of them on internet-facing assets, putting millions of websites and systems within reach of remote attackers.
Among the 156 million PHP package installations with a known version, only 28 per cent of vulnerable installations, representing 44 million, run supported PHP branches from 8.2 to 8.5, for which fixes are available.
A total of 110 million installations, or 71 per cent, run end-of-life or end-of-support PHP versions from 5.4 to 8.1. Most of these will not receive a vendor patch. As upgrading or patching PHP could have a business impact, Qualys recommends mitigation to reduce risk quickly.
The research also found that only 581,000 installations, or 0.37 per cent, were patched within the first 24 hours after disclosure.
The free trial includes products across the Qualys TruRisk Platform, including Qualys VMDR, Enterprise TruRisk Management (ETM) and TruRisk Eliminate, enabling security teams to move from discovery to a verified fix in one workflow.
Qualys solutions enable organisations to detect every vulnerable PHP instance within 60 minutes, including PHP running in containers or bundled inside other applications. Security teams can also prioritise internet-facing servers and legacy PHP versions and validate which servers attackers can actually exploit based on existing controls.
For supported PHP versions, organisations can apply patches and restart PHP services so that the fixes take effect. For PHP 8.1 and earlier, organisations can apply OS vendor backports where available, or isolate affected systems and plan their retirement. Organisations can then rescan systems to verify that exposures have been closed.
“PHP2Shell puts a large share of the web at risk, and over 70% of installations will not have a patch,” said Shailesh Athalye, Chief Product Solutions Officer, Qualys. “With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately. Qualys is making our services available so organisations can find, prioritise and close these exposures before they are exploited.”
Send news announcements/press releases to:
jeevika@thefoundermedia.in
About The Author
